AZ 104 (0) Merged

Vendor: Microsoft
Exam Code: AZ-104
Exam Name: Microsoft Azure Administrator
Version: 20.112
Important Notice
Product
Our Product Manager keeps an eye for Exam updates by Vendors. Free update is available within
One year after your purchase.
You can login member center and download the latest product anytime. (Product downloaded
from member center is always the latest.)
PS: Ensure you can pass the exam, please check the latest product in 2-3 days before the exam
again.
Feedback
We devote to promote the product quality and the grade of service to ensure customers interest.
If you have any questions about our product, please provide Exam Number, Version, Page
Number, Question Number, and your Login Account to us, please contact us at
support@passleader.com and our technical experts will provide support in 24 hours.
Copyright
The product of each order has its own encryption code, so you should use it independently.
If anyone who share the file we will disable the free update and account access.
Any unauthorized changes will be inflicted legal punishment. We will reserve the right of final
explanation for this statement.
Order ID: ****************
PayPal Name: ****************
PayPal ID: ****************

QUESTION 1
Hotspot Question
You have Azure virtual machines that run Windows Server 2019 and are configured as shown in
the following table.
You create a private Azure DNS zone named adatum.com. You configure the adatum.com zone
to allow auto registration from VNET1.
Which A records will be added to the adatum.com zone for each virtual machine? To answer,
select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Get Latest & Actual AZ-104 Exam's Question and Answers from Passleader. 2
http://www.passleader.com
Explanation:
The virtual machines are registered (added) to the private zone as A records pointing to their
private IP addresses.
Reference:
https://docs.microsoft.com/en-us/azure/dns/private-dns-overview
https://docs.microsoft.com/en-us/azure/dns/private-dns-scenarios
QUESTION 2
You plan to deploy three Azure virtual machines named VM1, VM2, and VM3. The virtual
machines will host a web app named App1.
You need to ensure that at least two virtual machines are available if a single Azure datacenter
becomes unavailable.
What should you deploy?
A. all three virtual machines in a single Availability Zone

B. all virtual machines in a single Availability Set
C. each virtual machine in a separate Availability Zone
D. each virtual machine in a separate Availability Set
Answer: B
Explanation:
Availability sets are a datacenter configuration to provide VM redundancy and availability. This
configuration within a datacenter ensures that during either a planned or unplanned maintenance
event, at least one virtual machine is available.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-machines/windows/manage-availability
https://docs.microsoft.com/en-us/azure/virtual-machines/windows/tutorial-availability-sets
QUESTION 3
You have an Azure virtual machine named VM1 that runs Windows Server 2019.
You save VM1 as a template named Template1 to the Azure Resource Manager library.
You plan to deploy a virtual machine named VM2 from Template1.
What can you configure during the deployment of VM2?
A. operating system
B. administrator username
C. virtual machine size
D. resource group
Answer: B
Explanation:
When deploying a virtual machine from a template, you must specify:
- the Resource Group name and location for the VM
- the administrator username and password
- an unique DNS name for the public IP
Reference:
https://docs.microsoft.com/en-us/azure/virtual-machines/windows/ps-template
QUESTION 4
You have an Azure subscription that contains an Azure virtual machine named VM1. VM1 runs a
financial reporting app named App1 that does not support multiple active instances.
At the end of each month, CPU usage for VM1 peaks when App1 runs.
You need to create a scheduled runbook to increase the processor performance of VM1 at the
end of each month.
What task should you include in the runbook?
A. Add the Azure Performance Diagnostics agent to VM1.

B. Modify the VM size property of VM1.
C. Add VM1 to a scale set.
D. Increase the vCPU quota for the subscription.
E. Add a Desired State Configuration (DSC) extension to VM1.
Answer: E
Explanation:
https://docs.microsoft.com/en-us/azure/automation/automation-quickstart-dsc-configuration
QUESTION 5
Note: This question is part of a series of questions that present the same scenario. Each
question in the series contains a unique solution that might meet the stated goals. Some
question sets might have more than one correct solution, while others might not have a
correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result,
these questions will not appear in the review screen.
You have an Azure subscription that contains 10 virtual networks. The virtual networks are hosted
in separate resource groups.
Another administrator plans to create several network security groups (NSGs) in the subscription.
You need to ensure that when an NSG is created, it automatically blocks TCP port 8080 between
the virtual networks.
Solution: You configure a custom policy definition, and then you assign the policy to the
subscription.
Does this meet the goal?
A. Yes
B. No
Answer: A
Explanation:
Resource policy definition used by Azure Policy enables you to establish conventions for
resources in your organization by describing when the policy is enforced and what effect to take.
By defining conventions, you can control costs and more easily manage your resources.
Reference:
https://docs.microsoft.com/en-us/azure/azure-policy/policy-definition
QUESTION 6
You have two Azure virtual networks named VNet1 and VNet2. VNet1 contains an Azure virtual
machine named VM1. VNet2 contains an Azure virtual machine named VM2.
VM1 hosts a frontend application that connects to VM2 to retrieve data.
Users report that the frontend application is slower than usual.
You need to view the average round-trip time (RTT) of the packets from VM1 to VM2.
Which Azure Network Watcher feature should you use?
A. IP flow verify
B. Connection troubleshoot
C. Connection monitor
D. NSG flow logs
Answer: C
Explanation:
The connection monitor capability monitors communication at a regular interval and informs you
of reachability, latency, and network topology changes between the VM and the endpoint
Incorrect Answers:
A: The IP flow verify capability enables you to specify a source and destination IPv4 address,
port, protocol (TCP or UDP), and traffic direction (inbound or outbound). IP flow verify then tests
the communication and informs you if the connection succeeds or fails. If the connection fails, IP
flow verify tells you which security rule allowed or denied the communication, so that you can
resolve the problem.
B: The connection troubleshoot capability enables you to test a connection between a VM and
another VM, an FQDN, a URI, or an IPv4 address. The test returns similar information returned
when using the connection monitor capability, but tests the connection at a point in time, rather
than monitoring it over time, as connection monitor does.
D: The NSG flow log capability allows you to log the source and destination IP address, port,
protocol, and whether traffic was allowed or denied by an NSG.
Reference:
https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-monitoring-overview
QUESTION 7
You have an Azure subscription that has a Recovery Services vault named Vault1. The
subscription contains the virtual machines shown in the following table:
You plan to schedule backups to occur every night at 23:00.
Which virtual machines can you back up by using Azure Backup?
A. VM1 and VM3 only

B. VM1, VM2, VM3 and VM4
C. VM1 and VM2 only
D. VM1 only
Answer: B
Explanation:
Azure Backup supports backup of 64-bit Windows server operating system from Windows Server
2008.
Azure Backup supports backup of 64-bit Windows 10 operating system.
Azure Backup supports backup of 64-bit Ubuntu Server operating system from Ubuntu 12.04.
Azure Backup supports backup of VM that are shutdown or offline.
Reference:
https://docs.microsoft.com/en-us/azure/backup/backup-support-matrix-iaas
https://docs.microsoft.com/en-us/azure/virtual-machines/linux/endorsed-distros
QUESTION 8
You have the Azure virtual machines shown in the following table:
You have a Recovery Services vault that protects VM1 and VM2.
You need to protect VM3 and VM4 by using Recovery Services.
What should you do first?
A. Create a new Recovery Services vault

B. Create a storage account
C. Configure the extensions for VM3 and VM4
D. Create a new backup policy
Answer: A
Explanation:
A Recovery Services vault is a storage entity in Azure that houses data. The data is typically
copies of data, or configuration information for virtual machines (VMs), workloads, servers, or
workstations. You can use Recovery Services vaults to hold backup data for various Azure
services.
Reference:
https://docs.microsoft.com/en-us/azure/site-recovery/azure-to-azure-tutorial-enable-replicatio
QUESTION 9
correct solution.
You have an Azure subscription that contains the following users in an Azure Active Directory
tenant named contoso.onmicrosoft.com:
User1 creates a new Azure Active Directory tenant named external.contoso.onmicrosoft.com.
You need to create new user accounts in external.contoso.onmicrosoft.com.
Solution: You instruct User2 to create the user accounts.
Does that meet the goal?
A. Yes
B. No
Answer: A
Explanation:
Only a global administrator can add users to this tenant.
Reference:
https://docs.microsoft.com/en-us/azure/devops/organizations/accounts/add-users-to-azure-ad
QUESTION 10
correct solution.
A. Yes
B. No
Answer: B
Explanation:
Reference:
QUESTION 11
correct solution.
A. Yes
B. No
Answer: B
Explanation:
Reference:
QUESTION 12
You have an Azure subscription that contains an Azure Active Directory (Azure AD) tenant
named contoso.com and an Azure Kubernetes Service (AKS) cluster named AKS1.
An administrator reports that she is unable to grant access to AKS1 to the users in contoso.com.
You need to ensure that access to AKS1 can be granted to the contoso.com users.
A. From contoso.com, modify the Organization relationships settings.

B. From contoso.com, create an OAuth 2.0 authorization endpoint.
C. Recreate AKS1.
D. From AKS1, create a namespace.
Answer: B
Explanation:
https://kubernetes.io/docs/reference/access-authn-authz/authentication/
QUESTION 13
You have a Microsoft 365 tenant and an Azure Active Directory (Azure AD) tenant named
contoso.com.
You plan to grant three users named User1, User2, and User3 access to a temporary Microsoft
SharePoint document library named Library1.
You need to create groups for the users. The solution must ensure that the groups are deleted
automatically after 180 days.
Which two groups should you create? Each correct answer presents a complete solution.
A. an Office 365 group that uses the Assigned membership type

B. a Security group that uses the Assigned membership type
C. an Office 365 group that uses the Dynamic User membership type
D. a Security group that uses the Dynamic User membership type
E. a Security group that uses the Dynamic Device membership type
Answer: AC
Explanation:
You can set expiration policy only for Office 365 groups in Azure Active Directory (Azure AD).
Note: With the increase in usage of Office 365 Groups, administrators and users need a way to
clean up unused groups. Expiration policies can help remove inactive groups from the system
and make things cleaner.
When a group expires, all of its associated services (the mailbox, Planner, SharePoint site, etc.)
are also deleted.
You can set up a rule for dynamic membership on security groups or Office 365 groups.
Incorrect Answers:
B, D, E: You can set expiration policy only for Office 365 groups in Azure Active Directory (Azure
AD).
Reference:
https://docs.microsoft.com/en-us/office365/admin/create-groups/office-365-groups-expiration-
policy?view=o365-worldwide
QUESTION 14
You have an Azure policy as shown in the following exhibit:
What is the effect of the policy?
A. You are prevented from creating Azure SQL servers anywhere in Subscription 1.
B. You can create Azure SQL servers in ContosoRG1 only.
C. You are prevented from creating Azure SQL Servers in ContosoRG1 only.
D. You can create Azure SQL servers in any resource group within Subscription 1.
Answer: B
Explanation:
You are prevented from creating Azure SQL servers anywhere in Subscription 1 with the
exception of ContosoRG1
QUESTION 15
You have an Azure subscription named AZPT1 that contains the resources shown in the following
table:
You create a new Azure subscription named AZPT2.
You need to identify which resources can be moved to AZPT2.
Which resources should you identify?
A. VM1, storage1, VNET1, and VM1Managed only

B. VM1 and VM1Managed only
C. VM1, storage1, VNET1, VM1Managed, and RVAULT1
D. RVAULT1 only
Answer: C
Explanation:
You can move a VM and its associated resources to a different subscription by using the Azure
portal.
You can now move an Azure Recovery Service (ASR) Vault to either a new resource group within
the current subscription or to a new subscription.
Reference:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/move-resource-
group-and-subscription
https://docs.microsoft.com/en-us/azure/key-vault/general/keyvault-move-subscription
QUESTION 16
You recently created a new Azure subscription that contains a user named Admin1.
Admin1 attempts to deploy an Azure Marketplace resource by using an Azure Resource Manager
template. Admin1 deploys the template by using Azure PowerShell and receives the following
error message: "User failed validation to purchase resources. Error message: "Legal terms have
not been accepted for this item on this subscription. To accept legal terms, please go to the Azure
portal (http:// go.microsoft.com/fwlink/?LinkId=534873) and configure programmatic deployment
for the Marketplace item or create it there for the first time."
You need to ensure that Admin1 can deploy the Marketplace resource successfully.
What should you do?
A. From Azure PowerShell, run the Set-AzApiManagementSubscription cmdlet

B. From the Azure portal, register the Microsoft.Marketplace resource provider
C. From Azure PowerShell, run the Set-AzMarketplaceTerms cmdlet
D. From the Azure portal, assign the Billing administrator role to Admin1
Answer: C
Explanation:
https://docs.microsoft.com/en-us/powershell/module/az.marketplaceordering/set-
azmarketplaceterms?view=azps-4.1.0
QUESTION 17
You have an Azure subscription that contains a policy-based virtual network gateway named
GW1 and a virtual network named VNet1.
You need to ensure that you can configure a point-to-site connection from an on-premises
computer to VNet1.
Which two actions should you perform? Each correct answer presents part of the solution.
A. Add a service endpoint to VNet1

B. Reset GW1
C. Create a route-based virtual network gateway
D. Add a connection to GW1
E. Delete GW1
F. Add a public IP address space to VNet1
Answer: CE
Explanation:
C: A VPN gateway is used when creating a VPN connection to your on-premises network.
Route-based VPN devices use any-to-any (wildcard) traffic selectors, and let routing/forwarding
tables direct traffic to different IPsec tunnels. It is typically built on router platforms where each
IPsec tunnel is modeled as a network interface or VTI (virtual tunnel interface).
E: Policy-based VPN devices use the combinations of prefixes from both networks to define how
traffic is encrypted/decrypted through IPsec tunnels. It is typically built on firewall devices that
perform packet filtering. IPsec tunnel encryption and decryption are added to the packet filtering
and processing engine.
Incorrect Answers:
F: Point-to-Site connections do not require a VPN device or a public-facing IP address.
Reference:
https://docs.microsoft.com/en-us/azure/vpn-gateway/create-routebased-vpn-gateway-portal
https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-connect-multiple-policybased-
rm-ps
QUESTION 18
You have five Azure virtual machines that run Windows Server 2016. The virtual machines are
configured as web servers.
You have an Azure load balancer named LB1 that provides load balancing services for the virtual
machines.
You need to ensure that visitors are serviced by the same web server for each request.
What should you configure?
A. Floating IP (direct server return) to Enabled

B. Idle Time-out (minutes) to 20
C. Protocol to UDP
D. Session persistence to Client IP and Protocol
Answer: D
Explanation:
With Sticky Sessions when a client starts a session on one of your web servers, session stays on
that specific server. To configure An Azure Load-Balancer For Sticky Sessions set Session
persistence to Client IP.
On the following image you can see sticky session configuration:
Reference:
https://cloudopszone.com/configure-azure-load-balancer-for-sticky-sessions/
QUESTION 19
Your on-premises network contains an SMB share named Share1.
You have an Azure subscription that contains the following resources:
- A web app named webapp1

- A virtual network named VNET1
You need to ensure that webapp1 can connect to Share1.
A. an Azure Application Gateway

B. an Azure Active Directory (Azure AD) Application Proxy
C. an Azure Virtual Network Gateway
Answer: C
Explanation:
A Site-to-Site VPN gateway connection can be used to connect your on-premises network to an
Azure virtual network over an IPsec/IKE (IKEv1 or IKEv2) VPN tunnel.
This type of connection requires a VPN device, a VPN gateway, located on-premises that has an
externally facing public IP address assigned to it.
Incorrect Answers:
B: Application Proxy is a feature of Azure AD that enables users to access on-premises web
applications from a remote client.
Reference:
https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-site-to-site-resource-
manager-portal
QUESTION 20
You plan to deploy several Azure virtual machines that will run Windows Server 2019 in a virtual
machine scale set by using an Azure Resource Manager template.
You need to ensure that NGINX is available on all the virtual machines after they are deployed.
What should you use?
A. Azure Active Directory (Azure AD) Application Proxy

B. Azure Application Insights
C. Azure Custom Script Extension
D. the New-AzConfigurationAssignement cmdlet
Answer: C
QUESTION 21
You have an Azure web app named webapp1.
Users report that they often experience HTTP 500 errors when they connect to webapp1.
You need to provide the developers of webapp1 with real-time access to the connection errors.
The solution must provide all the connection error details.
A. From webapp1, enable Web server logging

B. From Azure Monitor, create a workbook
C. From Azure Monitor, create a Service Health alert
D. From webapp1, turn on Application Logging
Answer: A
QUESTION 22
You have an Azure Active Directory (Azure AD) tenant that contains 5,000 user accounts.
You create a new user account named AdminUser1.
You need to assign the User administrator administrative role to AdminUser1.
What should you do from the user account properties?
A. From the Licenses blade, assign a new license

B. From the Directory role blade, modify the directory role
C. From the Groups blade, invite the user account to a new group
Answer: B
Explanation:
Assign a role to a user
1. Sign in to the Azure portal with an account that's a global admin or privileged role admin for the
directory.
2. Select Azure Active Directory, select Users, and then select a specific user from the list.
3. For the selected user, select Directory role, select Add role, and then pick the appropriate
admin roles from the Directory roles list, such as Conditional access administrator.
4. Press Select to save.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-users-
assign-role-azure-portal
QUESTION 23
You have an Azure Active Directory (Azure AD) tenant named contoso.onmicrosoft.com that
contains 100 user accounts.
You purchase 10 Azure AD Premium P2 licenses for the tenant.
You need to ensure that 10 users can use all the Azure AD Premium features.
What should you do?
A. From the Licenses blade of Azure AD, assign a license

B. From the Groups blade of each user, invite the users to a group
C. From the Azure AD domain, add an enterprise application
D. From the Directory role blade of each user, modify the directory role
Answer: A
Explanation:
https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/license-users-groups
QUESTION 24
You have an Azure subscription named Subscription1 and an on-premises deployment of
Microsoft System Center Service Manager.
Subscription1 contains a virtual machine named VM1.
You need to ensure that an alert is set in Service Manager when the amount of available memory
on VM1 is below 10 percent.
A. Create an automation runbook

B. Deploy a function app
C. Deploy the IT Service Management Connector (ITSM)
D. Create a notification
Answer: C
Explanation:
The IT Service Management Connector (ITSMC) allows you to connect Azure and a supported IT
Service Management (ITSM) product/service, such as the Microsoft System Center Service
Manager.
With ITSMC, you can create work items in ITSM tool, based on your Azure alerts (metric alerts,
Activity Log alerts and Log Analytics alerts).
Reference:
https://docs.microsoft.com/en-us/azure/azure-monitor/platform/itsmc-overview
QUESTION 25
You have an on-premises server that contains a folder named D:\Folder1.
You need to copy the contents of D:\Folder1 to the public container in an Azure Storage account
named contosodata.
Which command should you run?
A. https://contosodata.blob.core.windows.net/public
B. azcopy sync D:\folder1 https://contosodata.blob.core.windows.net/public -- snapshot
C. azcopy copy D:\folder1 https://contosodata.blob.core.windows.net/public -- recursive
D. az storage blob copy start-batch D:\Folder1 https://contosodata.blob.core.windows.net/public
Answer: C
Explanation:
The azcopy copy command copies a directory (and all of the files in that directory) to a blob
container. The result is a directory in the container by the same name.
Incorrect Answers:
B: The azcopy sync command replicates the source location to the destination location. However,
the file is skipped if the last modified time in the destination is more recent.
D: The az storage blob copy start-batch command copies multiple blobs to a blob container.
Reference:
https://docs.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-blobs
https://docs.microsoft.com/en-us/azure/storage/common/storage-ref-azcopy-copy
QUESTION 26
You have an Azure subscription named Subscription1 that contains the storage accounts shown
in the following table:
You plan to use the Azure Import/Export service to export data from Subscription1.
You need to identify which storage account can be used to export the data.
What should you identify?
A. storage1
B. storage2
C. storage3
D. storage4
Answer: D
Explanation:
Azure Import/Export service supports the following of storage accounts:
Standard General Purpose v2 storage accounts (recommended for most scenarios)
Blob Storage accounts
General Purpose v1 storage accounts (both Classic or Azure Resource Manager deployments),
Azure Import/Export service supports the following storage types:
Import supports Azure Blob storage and Azure File storage
Export supports Azure Blob storage
Reference:
https://docs.microsoft.com/en-us/azure/storage/common/storage-import-export-requirements
QUESTION 27
You have an Azure Storage account named storage1.
You plan to use AzCopy to copy data to storage1.
You need to identify the storage services in storage1 to which you can copy the data.
A. blob, file, table, and queue

B. blob and file only
C. file and table only
D. file only
E. blob, table, and queue only
Answer: B
Explanation:
AzCopy is a command-line utility that you can use to copy blobs or files to or from a storage
account.
Incorrect Answers:
A, C, E: AzCopy does not support table and queue storage services.
D: AzCopy supports file storage services, as well as blob storage services.
Reference:
https://docs.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-v10
QUESTION 28
You have an Azure subscription that contains an Azure Storage account.
You plan to create an Azure container instance named container1 that will use a Docker image
named Image1. Image1 contains a Microsoft SQL Server instance that requires persistent
storage.
You need to configure a storage service for Container1.
A. Azure Files
B. Azure Blob storage
C. Azure Queue storage
D. Azure Table storage
Answer: D
QUESTION 29
You sign in to VM1 as a user named User1 and perform the following actions:
- Create files on drive C.

- Create files on drive D.
- Modify the screen saver timeout.
- Change the desktop background.
You plan to redeploy VM1.
Which changes will be lost after you redeploy VM1?
A. the modified screen saver timeout

B. the new desktop background
C. the new files on drive D
D. the new files on drive C
Answer: A
QUESTION 30
You have an Azure subscription.
You have an on-premises virtual machine named VM1. The settings for VM1 are shown in the
exhibit.
(Click the Exhibit tab.)
You need to ensure that you can use the disks attached to VM1 as a template for Azure virtual
machines.
What should you modify on VM1?
A. the memory
B. the network adapters
C. the hard drive
D. the processor
E. Integration Services
Answer: C
Explanation:
From the exhibit we see that the disk is in the VHDX format.
Before you upload a Windows virtual machine (VM) from on-premises to Microsoft Azure, you
must prepare the virtual hard disk (VHD or VHDX). Azure supports only generation 1 VMs that
are in the VHD file format and have a fixed sized disk. The maximum size allowed for the VHD is
1,023 GB. You can convert a generation 1 VM from the VHDX file system to VHD and from a
dynamically expanding disk to fixed-sized.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-machines/windows/prepare-for-upload-vhd-image
QUESTION 31
You have an Azure subscription named Subscription1 that is used by several departments at your
company. Subscription1 contains the resources in the following table:
Another administrator deploys a virtual machine named VM1 and an Azure Storage account
named storage2 by using a single Azure Resource Manager template.
You need to view the template used for the deployment.
From which blade can you view the template that was used for the deployment?
A. VM1
B. RG1
C. storage2
D. container1
Answer: B
Explanation:
View template from deployment history
1. Go to the resource group for your new resource group. Notice that the portal shows the result
of the last deployment. Select this link.
2. You see a history of deployments for the group. In your case, the portal probably lists only one
deployment. Select this deployment.
3. The portal displays a summary of the deployment. The summary includes the status of the
deployment and its operations and the values that you provided for parameters. To see the
template that you used for the deployment, select View template.
Reference:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-manager-export-
template
QUESTION 32
You have an Azure web app named App1. App1 has the deployment slots shown in the following
table:
In webapp1-test, you test several changes to App1.
You back up App1.
You swap webapp1-test for webapp1-prod and discover that App1 is experiencing performance
issues. You need to revert to the previous version of App1 as quickly as possible.
What should you do?
A. Redeploy App1
B. Swap the slots
C. Clone App1
D. Restore the backup of App1
Answer: B
Explanation:
When you swap deployment slots, Azure swaps the Virtual IP addresses of the source and
destination slots, thereby swapping the URLs of the slots. We can easily revert the deployment by
swapping back.
Reference:
https://docs.microsoft.com/en-us/azure/app-service/deploy-staging-slots
QUESTION 33
correct solution.
Solution: From the Resource providers blade, you unregister the Microsoft.ClassicNetwork
provider.
A. Yes
B. No
Answer: B
Explanation:
You should use a policy definition.
Reference:
QUESTION 34
correct solution.
Solution: You assign a built-in policy definition to the subscription.
A. Yes
B. No
Answer: B
Explanation:
Reference:
QUESTION 35
You have an app named App1 that runs on two Azure virtual machines named VM1 and VM2.
You plan to implement an Azure Availability Set for App1. The solution must ensure that App1 is
available during planned maintenance of the hardware hosting VM1 and VM2.
What should you include in the Availability Set?
A. one update domain

B. two fault domains
C. one fault domain
D. two update domains
Answer: D
Explanation:
Microsoft updates, which Microsoft refers to as planned maintenance events, sometimes require
that VMs be rebooted to complete the update. To reduce the impact on VMs, the Azure fabric is
divided into update domains to ensure that not all VMs are rebooted at the same time.
Incorrect Answers:
A: An update domain is a group of VMs and underlying physical hardware that can be rebooted at
the same time.
B, C: A fault domain shares common storage as well as a common power source and network
switch. It is used to protect against unplanned system failure.
References:
https://petri.com/understanding-azure-availability-sets
QUESTION 36
correct solution.
You have an Azure subscription named Subscription1. Subscription1 contains a resource group
named RG1. RG1 contains resources that were deployed by using templates.
You need to view the date and time when the resources were created in RG1.
Solution: From the Subscriptions blade, you select the subscription, and then click Programmatic
deployment.
A. Yes
B. No
Answer: B
Explanation:
From the RG1 blade, click Deployments. You see a history of deployment for the resource group.
Reference:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/template-tutorial-
create-first-template?tabs=azure-powershell
QUESTION 37
correct solution.
Solution: From the RG1 blade, you click Automation script.
A. Yes
B. No
Answer: B
Explanation:
Reference:
QUESTION 38
correct solution.
Solution: From the RG1 blade, you click Deployments.
A. Yes
B. No
Answer: A
Explanation:
Reference:
QUESTION 39
Hotspot Question
You have an Azure subscription named Subscription1 that contains a resource group named
RG1.
In RG1, you create an internal load balancer named LB1 and a public load balancer named LB2.
You need to ensure that an administrator named Admin1 can manage LB1 and LB2. The solution
must follow the principle of least privilege.
Which role should you assign to Admin1 for each task? To answer, select the appropriate options
in the answer area.
Answer:
Explanation:
The Network Contributor role lets you manage networks, but not access them.
Reference:
https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles
QUESTION 40
Hotspot Question
You have an Azure Active Directory (Azure AD) tenant named contoso.com that contains the
users shown in the following table:
User3 is the owner of Group1.
Group2 is a member of Group1.
You configure an access review named Review1 as shown in the following exhibit:
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
Answer:
Explanation:
https://docs.microsoft.com/en-us/azure/active-directory/governance/create-access-review
QUESTION 41
Hotspot Question
You have the Azure management groups shown in the following table:
You add Azure subscriptions to the management groups as shown in the following table:
You create the Azure policies shown in the following table:
Answer:
Explanation:
Box 1: No
Virtual networks are not allowed at the root and is inherited. Deny overrides allowed.
Box 2: Yes
Virtual Machines can be created on a Management Group provided the user has the required
RBAC permissions.
Box 3: Yes
Subscriptions can be moved between Management Groups provided the user has the required
RBAC permissions.
Reference:
https://docs.microsoft.com/en-us/azure/governance/management-groups/overview
https://docs.microsoft.com/en-us/azure/governance/management-groups/manage#moving-
management-groups-and-subscriptions
QUESTION 42
Hotspot Question
You have an Azure subscription that contains the resources shown in the following table:
You assign a policy to RG6 as shown in the following table:
To RG6, you apply the tag: RGroup: RG6.
You deploy a virtual network named VNET2 to RG6.
Which tags apply to VNET1 and VNET2? To answer, select the appropriate options in the answer
area.
Answer:
Explanation:
VNET1: Department: D1, and Label:Value1 only.
Tags applied to the resource group or subscription are not inherited by the resources.
Note: Azure Policy allows you to use either built-in or custom-defined policy definitions and assign
them to either a specific resource group or across a whole Azure subscription.
VNET2: Label:Value1 only.
Incorrect Answers:
RGROUP: RG6
Reference:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/tag-policies
QUESTION 43
Hotspot Question
You have an Azure subscription named Subscription1.
In Subscription1, you create an Azure file share named share1.
You create a shared access signature (SAS) named SAS1 as shown in the following exhibit:
To answer, select the appropriate options in the answer area.
Answer:
Explanation:
Box 1: Will have no access
The IP 193.77.134.1 does not have access on the SAS.
Box 2: Will have read, write, and list access

The net use command is used to connect to file shares.
References:
https://docs.microsoft.com/en-us/azure/storage/common/storage-dotnet-shared-access-
signature-part-1
https://docs.microsoft.com/en-us/azure/vs-azure-tools-storage-manage-with-storage-explorer?
tabs=windows
QUESTION 44
Hotspot Question
You have Azure subscription that includes following Azure file shares:
You have the following on-premises servers:
You create a Storage Sync Service named Sync1 and an Azure File Sync group named Group1.
Group1 uses share1 as a cloud endpoint.
You register Server1 and Server2 in Sync1. You add D:\Folder1 on Server1 as a server endpoint
of Group1.
Answer:
Explanation:
Box 1: No
Group1 already has a cloud endpoint named Share1.
A sync group must contain one cloud endpoint, which represents an Azure file share and one or
more server endpoints.
Box 2: Yes
Yes, one or more server endpoints can be added to the sync group.
Box 3: Yes
Reference:
https://docs.microsoft.com/en-us/azure/storage/files/storage-sync-files-deployment-guide
QUESTION 45
Drag and Drop Question
You create an Azure Storage account named contosostorage, and then you create a file share
named data.
Which UNC path should you include in a script that references files from the data file share? To
answer, drag the appropriate values to the correct targets. Each value may be used once, more
than once or not at all. You may need to drag the split bar between panes or scroll to view
content.
Answer:
Explanation:
Box 1: contosostorage
The name of account
Box 2: file.core.windows.net
Box 3: data
The name of the file share is data.
Example:
Reference:
https://docs.microsoft.com/en-us/azure/storage/files/storage-how-to-use-files-windows
QUESTION 46
You have an on-premises file server named Server1 that runs Windows Server 2016.
You have an Azure subscription that contains an Azure file share.
You deploy an Azure File Sync Storage Sync Service, and you create a sync group.
You need to synchronize files from Server1 to Azure.
Which three actions should you perform in sequence? To answer, move the appropriate actions
from the list of actions to the answer area and arrange them in the correct order.
Answer:
Explanation:
Step 1: Install the Azure File Sync agent on Server1
The Azure File Sync agent is a downloadable package that enables Windows Server to be
synced with an Azure file share
Step 2: Register Server1.

Register Windows Server with Storage Sync Service
Registering your Windows Server with a Storage Sync Service establishes a trust relationship
between your server (or cluster) and the Storage Sync Service.
Step 3: Add a server endpoint

Create a sync group and a cloud endpoint.
A sync group defines the sync topology for a set of files. Endpoints within a sync group are kept
in sync with each other. A sync group must contain one cloud endpoint, which represents an
Azure file share and one or more server endpoints. A server endpoint represents a path on
registered server.
Reference:
QUESTION 47
Hotspot Question
You have an Azure subscription. The subscription contains virtual machines that run Windows
Server 2016 and are configured as shown in the following table.
You create a public Azure DNS zone named adatum.com and a private Azure DNS zone named
contoso.com.
You create a virtual network link for contoso.com as shown in the following exhibit.
Answer:
Explanation:
https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-name-resolution-for-vms-
and-role-instances
https://docs.microsoft.com/en-us/azure/dns/private-dns-autoregistration
QUESTION 48
Hotspot Question
You have an Azure Storage account named storage1 that uses Azure Blob storage and Azure
File storage.
You need to use AzCopy to copy data to the blob storage and file storage in storage1.
Which authentication method should you use for each type of storage? To answer, select the
appropriate options in the answer area.
Answer:
Explanation:
You can provide authorization credentials by using Azure Active Directory (AD), or by using a
Shared Access Signature (SAS) token.
Box 1:
Both Azure Active Directory (AD) and Shared Access Signature (SAS) token are supported for
Blob storage.
Box 2:
Only Shared Access Signature (SAS) token is supported for File storage.
Reference:
QUESTION 49
Hotspot Question
You have an Azure subscription named Subscription1 that contains the resources shown in the
following table:
You plan to configure Azure Backup reports for Vault1.
You are configuring the Diagnostics settings for the AzureBackupReports log.
Which storage accounts and which Log Analytics workspaces can you use for the Azure Backup
reports of Vault1? To answer, select the appropriate options in the answer area.
Answer:
Explanation:
Box 1: storage3 only
Vault1 and storage3 are both in West Europe.
Box 2: Analytics3
Vault1 and Analytics3 are both in West Europe.
Reference:
https://docs.microsoft.com/en-us/azure/backup/backup-azure-configure-reports
QUESTION 50
Hotspot Question
You have an Azure subscription named Subscription1. Subscription1 contains a virtual machine
named VM1.
You install and configure a web server and a DNS server on VM1.
VM1 has the effective network security rules shown in the following exhibit:
Use the drop-down menus to select the answer choice that completes each statement based on
the information presented in the graphic.
Answer:
QUESTION 51
Hotspot Question
You have an Azure subscription that contains a virtual machine scale set. The scale set contains
four instances that have the following configurations:
- Operating system: Windows Server 2016

- Size: Standard_D1_v2
You run the get-azvmss cmdlet as shown in the following exhibit:
Answer:
Explanation:
The Get-AzVmssVM cmdlet gets the model view and instance view of a Virtual Machine Scale
Set (VMSS) virtual machine.
Box 1: 0
The enableAutomaticUpdates parameter is set to false. To update existing VMs, you must do a
manual upgrade of each existing VM.
Box 2: 4
Enabling automatic OS image upgrades on your scale set helps ease update management by
safely and automatically upgrading the OS disk for all instances in the scale set.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-
upgrade-scale-set
automatic-upgrade
QUESTION 52
Hotspot Question
You have an Azure subscription that contains the resources in the following table:
In Azure, you create a private DNS zone named adatum.com. You set the registration virtual
network to VNet2. The adatum.com zone is configured as shown in the following exhibit:
Answer:
Explanation:
Box 1: No
Azure DNS provides automatic registration of virtual machines from a single virtual network that's
linked to a private zone as a registration virtual network. VM5 does not belong to the registration
virtual network though.
Box 2: No
Forward DNS resolution is supported across virtual networks that are linked to the private zone
as resolution virtual networks. VM5 does belong to a resolution virtual network.
Box 3: Yes
VM6 belongs to registration virtual network, and an A (Host) record exists for VM9 in the DNS
zone. By default, registration virtual networks also act as resolution virtual networks, in the sense
that DNS resolution against the zone works from any of the virtual machines within the
registration virtual network.
Reference:
QUESTION 53
Hotspot Question
You have an Azure subscription that contains a virtual network named VNet1. VNet1 uses an IP
address space of 10.0.0.0/16 and contains the subnets in the following table:
Subnet1 contains a virtual appliance named VM1 that operates as a router.
You create a routing table named RT1.
You need to route all inbound traffic from the VPN gateway to VNet1 through VM1.
How should you configure RT1? To answer, select the appropriate options in the answer area.
Answer:
QUESTION 54
Hotspot Question
You have an Azure subscription that contains the virtual machines shown in the following table:
VM1 and VM2 use public IP addresses. From Windows Server 2019 on VM1 and VM2, you allow
inbound Remote Desktop connections.
Subnet1 and Subnet2 are in a virtual network named VNET1.
The subscription contains two network security groups (NSGs) named NSG1 and NSG2. NSG1
uses only the default rules.
NSG2 uses the default rules and the following custom incoming rule:
- Priority: 100
- Name: Rule1
- Port: 3389
- Protocol: TCP
- Source: Any
- Destination: Any
- Action: Allow
NSG1 is associated to Subnet1. NSG2 is associated to the network interface of VM2.
Answer:
QUESTION 55
Hotspot Question
You have a virtual network named VNET1 that contains the subnets shown in the following table:
You have two Azure virtual machines that have the network configurations shown in the following
table:
For NSG1, you create the inbound security rule shown in the following table:
Answer:
Explanation:
Box 1: Yes
The inbound security rule for NSG1 allows TCP port 1433 from 10.10.2.0/24 (or Subnet2 where
VM2 and VM3 are located) to 10.10.1.0/24 (or Subnet1 where VM1 is located) while the inbound
security rule for NSG2 blocks TCP port 1433 from 10.10.2.5 (or VM2) to 10.10.1.5 (or VM1).
However, the NSG1 rule has a higher priority (or lower value) than the NSG2 rule.
Box 2: Yes
No rule explicitly blocks communication from VM1. The default rules, which allow communication,
are thus applied.
Box 3: Yes
No rule explicitly blocks communication between VM2 and VM3 which are both on Subnet2. The
default rules, which allow communication, are thus applied.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/security-overview
QUESTION 56
Hotspot Question
Subscription1 contains the virtual machines in the following table:
Subscription1 contains a virtual network named VNet1 that has the subnets in the following table:
VM3 has multiple network adapters, including a network adapter named NIC3. IP forwarding is
enabled on NIC3. Routing is enabled on VM3.
You create a route table named RT1 that contains the routes in the following table:
You apply RT1 to Subnet1 and Subnet2.
Answer:
Explanation:
IP forwarding enables the virtual machine a network interface is attached to:
Receive network traffic not destined for one of the IP addresses assigned to any of the IP
configurations assigned to the network interface.
Send network traffic with a different source IP address than the one assigned to one of a network
interface's IP configurations.
The setting must be enabled for every network interface that is attached to the virtual machine
that receives traffic that the virtual machine needs to forward. A virtual machine can forward traffic
whether it has multiple network interfaces or a single network interface attached to it.
Box 1: Yes
The routing table allows connections from VM3 to VM1 and VM2. And as IP forwarding is enabled
on VM3, VM3 can connect to VM1.
Box 2: No
VM3, which has IP forwarding, must be turned on, in order for VM2 to connect to VM1.
Box 3: Yes
The routing table allows connections from VM1 and VM2 to VM3. IP forwarding on VM3 allows
VM1 to connect to VM2 via VM3.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview
QUESTION 57
Hotspot Question
You create a Recovery Services vault backup policy named Policy1 as shown in the following
exhibit:
Answer:
Explanation:
Box 1: 10 years
The yearly backup point occurs to 1 March and its retention period is 10 years.
Box 2: 36 months
The monthly backup point occurs on the 1st of every month and its retention period is 36 months.
QUESTION 58
You have an Azure subscription that contains 10 virtual machines. You need to ensure that you
receive an email message when any virtual machines are powered off, restarted, or deallocated.
What is the minimum number of rules and action groups that you require?
A. three rules and three action groups

B. one rule and one action group
C. three rules and one action group
D. one rule and three action groups
Answer: C
Explanation:
An action group is a collection of notification preferences defined by the user. Azure Monitor and
Service
Health alerts are configured to use a specific action group when the alert is triggered. Various
alerts may use the same action group or different action groups depending on the user's
requirements. References: https://docs.microsoft.com/en-us/azure/monitoring-and-
diagnostics/monitoring-action-groups
QUESTION 59
You have an Azure subscription that contains two resource groups named RG1 and RG2. RG2
does not contain any resources. RG1 contains the resources in the following table.
Which resource can you move to RG2?
A. W10_OsDisk
B. VNet1
C. VNet3
D. W10
Answer: B
Explanation:
When moving a virtual network, you must also move its dependent resources. For example, you
must move gateways with the virtual network. VM W10, which is in Vnet1, is not a dependent
resource.
Incorrect Answers:
A: Managed disks don't support move.
C: Virtual networks (classic) can't be moved.
D: Virtual machines with the managed disks cannot be moved.
References: https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-
move-resources#virtual-machines-limitations
QUESTION 60
You have 100 Azure subscriptions. All the subscriptions are associated to the same Azure Active
Directory (Azure AD) tenant named contoso.com.
You are a global administrator.
You plan to create a report that lists all the resources across all the subscriptions.
You need to ensure that you can view all the resources in all the subscriptions.
What should you do?
A. From the Azure portal, modify the profile settings of your account.
B. From Windows PowerShell, run the Add-AzureADAdministrativeUnitMember cmdlet.
C. From Windows PowerShell, run the New-AzureADUserAppRoleAssignment cmdlet.
D. From the Azure portal, modify the properties of the Azure AD tenant.
Answer: D
Explanation:
https://docs.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-
admin#azure-portal
QUESTION 61
correct solution. After you answer a question in this section, you will NOT be able to
return to it. As a result, these questions will not appear in the review screen.
named RG1. RG1 contains resources that were deployed by using templates. You need to view
the date and time when the resources were created in RG1.
deployment.
A. Yes
B. No
Answer: B
QUESTION 62
A. Yes
B. No
Answer: A
QUESTION 63
Solution: From the Subscriptions blade, you select the subscription, and then click Resource
providers.
A. Yes
B. No
Answer: B
QUESTION 64
You have the Azure virtual machines shown in the following table.
A. Configure the extensions for VM3 and VM4.

B. Create a new Recovery Services vault.
C. Create a storage account.
D. Create a new backup policy.
Answer: B
Explanation:
A Recovery Services vault is a storage entity in Azure that houses data. The data is typically
copies of data, or configuration information for virtual machines (VMs), workloads, servers, or
workstations. You can use Recovery Services vaults to hold backup data for various Azure
services References: https://docs.microsoft.com/en-us/azure/site-recovery/azure-to-azure-
tutorial-enable-replication
QUESTION 65
You have an Azure subscription that contains the resources in the following table.
Store1 contains a file share named Data. Data contains 5,000 files.
You need to synchronize the files in Data to an on-premises server named Server1.
Which three actions should you perform? Each correct answer presents part of the solution.
A. Download an automation script.

B. Create a container instance.
C. Create a sync group.
D. Register Server1.
E. Install the Azure File Sync agent on Server1.
Answer: CDE
Explanation:
Step 1 (E): Install the Azure File Sync agent on Server1 The Azure File Sync agent is a
downloadable package that enables Windows Server to be synced with an Azure file share
Step 2 (D): Register Server1.
between your server (or cluster) and the Storage Sync Service. Step 3 (C): Create a sync group
and a cloud endpoint. A sync group defines the sync topology for a set of files. Endpoints within a
sync group are kept in sync with each other. A sync group must contain one cloud endpoint,
which represents an Azure file share and one or more server endpoints. A server endpoint
represents a path on registered server.
References: https://docs.microsoft.com/en-us/azure/storage/files/storage-sync-files-deployment-
guide
QUESTION 66
You plan to use the Azure Import/Export service to copy files to a storage account.
Which two files should you create before you prepare the drives for the import job? Each correct
answer presents part of the solution.
A. an XML manifest file
B. a driveset CSV file
C. a dataset CSV file
D. a PowerShell PS1 file
E. a JSON configuration file
Answer: BC
Explanation:
B: Modify the driveset.csv file in the root folder where the tool resides.
C: Modify the dataset.csv file in the root folder where the tool resides. Depending on whether you
want to import a file or folder or both, add entries in the dataset.csv file
References: https://docs.microsoft.com/en-us/azure/storage/common/storage-import-export-data-
to-files
QUESTION 67
You have a Recovery Service vault that you use to test backups. The test backups contain two
protected virtual machines.
You need to delete the Recovery Services vault.
A. From the Recovery Service vault, stop the backup of each backup item.
B. From the Recovery Service vault, delete the backup data.
C. Modify the disaster recovery properties of each virtual machine.
D. Modify the locks of each virtual machine.
Answer: A
Explanation:
You can't delete a Recovery Services vault if it is registered to a server and holds backup data. If
you try to delete a vault, but can't, the vault is still configured to receive backup data.
Remove vault dependencies and delete vault
In the vault dashboard menu, scroll down to the Protected Items section, and click Backup Items.
In this menu, you can stop and delete Azure File Servers, SQL Servers in Azure VM, and Azure
virtual machines.
References: https://docs.microsoft.com/en-us/azure/backup/backup-azure-delete-vault
virtual machines.
QUESTION 68
You have an Azure subscription that contains 100 virtual machines.
You regularly create and delete virtual machines.
You need to identify unused disks that can be deleted.
What should you do?
A. From Microsoft Azure Storage Explorer, view the Account Management properties.
B. From the Azure portal, configure the Advisor recommendations.
C. From Cloudyn, open the Optimizer tab and create a report.
D. From Cloudyn, create a Cost Management report.
Answer: C
Explanation:
What is the Cloudyn service?
https://docs.microsoft.com/en-us/azure/cost-management/overview
You can determine optimal VM usage and identify idle VMs or remove idle VMs and unattached
disks with Cloudyn. Using information in Sizing Optimization and Inefficiency reports, you can
create a plan to down-size or remove idle VMs. However, optimization reports are not currently
supported for CSP partner accounts or subscriptions.
If you provisioned AWS Reserved Instances, you can improve your reserved instances utilization
with Optimization reports where you can view buying recommendations, modify unused
reservations, and plan provisioning.”
QUESTION 69
You deploy a Linux virtual machine named VM1 to Subscription1.
You need to monitor the metrics and the logs of VM1.
A. Linux Diagnostic Extension (LAD) 3.0

B. Azure Analysis Services
C. The AzurePerformanceDiagnostics extension
D. Azure HDInsight
Answer: A
Explanation:
https://docs.microsoft.com/en-us/azure/virtual-machines/extensions/diagnostics-linux
QUESTION 70
named VM1.
You have a computer named Computer1 that runs Windows 10. Computer1 is connected to the
Internet.
You add a network interface named Interface1 to VM1 as shown in the exhibit (Click the Exhibit
button.)
From Computer1, you attempt to connect to VM1 by using Remote Desktop, but the connection
fails.
You need to establish a Remote Desktop connection to VM1.
A. Start VM1.
B. Attach a network interface.
C. Delete the DenyAllOutBound outbound port rule.
D. Delete the DenyAllInBound inbound port rule.
Answer: A
Explanation:
Incorrect Answers:
B: The network interface has already been added to VM.
C: The Outbound rules are fine.
D: The inbound rules are fine. Port 3389 is used for Remote Desktop. Note: Rules are processed
in priority order, with lower numbers processed before higher numbers, because lower numbers
have higher priority. Once traffic matches a rule, processing stops. As a result, any rules that
exist with lower priorities (higher numbers) that have the same attributes as rules with higher
priorities are not processed.
References: https://docs.microsoft.com/en-us/azure/virtual-network/security-overview
QUESTION 71
You plan to automate the deployment of a virtual machine scale set that uses the Windows
Server 2016 Datacenter image.
You need to ensure that when the scale set virtual machines are provisioned, they have web
server components installed.
NOTE Each correct selection is worth one point.
A. Modify the extensionProfile section of the Azure Resource Manager template.

B. Create a new virtual machine scale set in the Azure portal.
C. Create an Azure policy.
D. Create an automation account.
E. Upload a configuration script.
Answer: AE
Explanation:
deploy-app
QUESTION 72
You have an Azure subscription that contains a virtual machine named VM1. VM1 hosts a line-of-
business application that is available 24 hours a day.
VM1 has one network interface and one managed disk. VM1 uses the D4s v3 size.
You plan to make the following changes to VM1:
Change the size to D8s v3.

Add a 500-GB managed disk.
Add the Puppet Agent extension.
Attach an additional network interface.
Which change will cause downtime for VM1?
A. Add a 500-GB managed disk.

B. Attach an additional network interface.
C. Add the Puppet Agent extension.
D. Change the size to D8s v3.
Answer: D
Explanation:
While resizing the VM it must be in a stopped state.
References: https://azure.microsoft.com/en-us/blog/resize-virtual-machines/
QUESTION 73
You have an Azure virtual machine named VM1. VM1 was deployed by using a custom Azure
Resource Manager template named ARM1.json.
You receive a notification that VM1 will be affected by maintenance. You need to move VM1 to a
different host immediately.
Solution: From the Redeploy blade, you click Redeploy.
A. Yes
B. No
Answer: A
Explanation:
When you redeploy a VM, it moves the VM to a new node within the Azure infrastructure and then
powers it back on, retaining all your configuration options and associated resources.
References: https://docs.microsoft.com/en-us/azure/virtual-machines/windows/redeploy-to-new-
node
QUESTION 74
You receive a notification that VM1 will be affected by maintenance. You need to move VM1 to a
different host immediately.
Solution: From the Overview blade, you move the virtual machine to a different resource group.
A. Yes
B. No
Answer: B
Explanation:
You should redeploy the VM.
node
QUESTION 75
Subnet1 is associated to VNet1. NIC1 attaches VM1 to Subnet1.
You need to apply ASG1 to VM1.
What should you do?
A. Modify the properties of NSG1.

B. Modify the properties of ASG1.
C. Associate NIC1 to ASG1.
Answer: C
Explanation:
NSG’s are associated to NICs and Subnets, not VM’s.
https://docs.microsoft.com/en-us/azure/virtual-network/tutorial-filter-network-traffic
QUESTION 76
You have two subscriptions named Subscription1 and Subscription2. Each subscription is
associated to a different Azure AD tenant.
Subscription1 contains a virtual network named VNet1.VNet1 contains an Azure virtual machine
named VM1 and has an IP address space of 10.0.0.0/16. Subscription2 contains a virtual network
named VNet2. VNet2 contains an Azure virtual machine named VM2 and has an IP address
space of 10.10.0.0/24.
You need to connect VNet1 to VNet2.
A. Move VNet1 to Subscription2.

B. Modify the IP address space of VNet2.
C. Provision virtual network gateways.
D. Move VM1 to Subscription2.
Answer: C
Explanation:
The virtual networks can be in the same or different regions, and from the same or different
subscriptions. When connecting VNets from different subscriptions, the subscriptions do not need
to be associated with the same Active Directory tenant.
Configuring a VNet-to-VNet connection is a good way to easily connect VNets. Connecting a
virtual network to another virtual network using the VNet-to-VNet connection type (VNet2VNet) is
similar to creating a Site-to-Site IPsec connection to an on-premises location. Both connectivity
types use a VPN gateway to provide a secure tunnel using IPsec/IKE, and both function the same
way when communicating.
The local network gateway for each VNet treats the other VNet as a local site. This lets you
specify additional address space for the local network gateway in order to route traffic.
References: https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-vnet-vnet-
resource-manager-portal
QUESTION 77
Your company has an Azure subscription named Subscription1. The company also has two on-
premises servers named Server1 and Server2 that run Windows Server 2016. Server1 is
configured as a DNS server that has a primary DNS zone named adatum.com.
Adatum.com contains 1,000 DNS records.
You manage Server1 and Subscription1 from Server2. Server2 has the following tools installed:
- The DNS Manager console

- Azure PowerShell
- Azure CLI 2.0
You need to move the adatum.com zone to Subscription1. The solution must minimize
administrative effort.
A. Azure PowerShell
B. Azure CLI
C. the Azure portal
D. the DNS Manager console
Answer: B
Explanation:
Azure DNS supports importing and exporting zone files by using the Azure command-line
interface (CLI). Zone file import is not currently supported via Azure PowerShell or the Azure
portal. References: https://docs.microsoft.com/en-us/azure/dns/dns-import-export
QUESTION 78
VM1 and VM2 are deployed from the same template and host line-of-business applications
accessed by using Remote Desktop. You configure the network security group (NSG) shown in
the exhibit. (Click the Exhibit button.)
You need to prevent users of VM1 and VM2 from accessing websites on the Internet.
What should you do?
A. Associate the NSG to Subnet1.

B. Disassociate the NSG from a network interface.
C. Change the DenyWebSites outbound security rule.
D. Change the Port_80 inbound security rule.
Answer: A
Explanation:
You can associate or dissociate a network security group from a network interface or subnet. The
NSG has the appropriate rule to block users from accessing the Internet. We just need to
associate it with Subnet1.
References: https://docs.microsoft.com/en-us/azure/virtual-network/manage-network-security-
group
QUESTION 79
To which subnets can you apply NSG1?
A. the subnets on VNet2 only

B. the subnets on VNet1 only
C. the subnets on VNet2 and VNet3 only
D. the subnets on VNet1, VNet2, and VNet3
E. the subnets on VNet3 only
Answer: E
Explanation:
All Azure resources are created in an Azure region and subscription. A resource can only be
created in a virtual network that exists in the same region and subscription as the resource.
References: https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-vnet-plan-
design-arm
QUESTION 80
You create an Azure Storage account named contosostorage.
You plan to create a file share named data.
Users need to map a drive to the data file share from home computers that run Windows 10.
Which port should be open between the home computers and the data file share?
A. 80
B. 443
C. 445
D. 3389
Answer: C
Explanation:
Ensure port 445 is open: The SMB protocol requires TCP port 445 to be open; connections will
fail if port 445 is blocked.
References: https://docs.microsoft.com/en-us/azure/storage/files/storage-how-to-use-files-
windows
QUESTION 81
You have an Azure Active Directory (Azure AD) tenant named contosocloud.onmicrosoft.com.
Your company has a public DNS zone for contoso.com.
You add contoso.com as a custom domain name to Azure AD. You need to ensure that Azure
can verify the domain name.
Which type of DNS record should you create?
A. RRSIG
B. PTR
C. DNSKEY
D. TXT
Answer: D
Explanation:
Create the TXT record. App Services uses this record only at configuration time to verify that you
own the custom domain. You can delete this TXT record after your custom domain is validated
and configured in App Service.
References: https://docs.microsoft.com/en-us/azure/dns/dns-web-sites-custom-domain
QUESTION 82
Solution: From the Resource providers blade, you unregister the Microsoft.ClassicNetwork
provider.
A. Yes
B. No
Answer: B
QUESTION 83
subscription.
A. Yes
B. No
Answer: A
Explanation:
References: https://docs.microsoft.com/en-us/azure/azure-policy/policy-definition
QUESTION 84
Solution: You create a resource lock, and then you assign the lock to the subscription.
A. Yes
B. No
Answer: B
Explanation:
How can I freeze or lock my production/critical Azure resources from accidental deletion? There
is way to do this with both ASM and ARM resources using Azure resource lock.
References: https://blogs.msdn.microsoft.com/azureedu/2016/04/27/using-azure-resource-
manager-policy-and-azure-lock-to-control-your-azure-resources/
QUESTION 85
You have an Azure Active Directory (Azure AD) domain that contains 5,000 user accounts.
A. From the Directory role blade, modify the directory role.

B. From the Groups blade, invite the user account to a new group.
C. From the Licenses blade, assign a new license.
Answer: A
Explanation:
Sign in to the Azure portal with an account that's a global admin or privileged role admin for the
directory.
Select Azure Active Directory, select Users, and then select a specific user from the list. For the
selected user, select Directory role, select Add role, and then pick the appropriate admin roles
from the Directory roles list, such as Conditional access administrator.
Press Select to save.
References: https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-
directory-users-assign-role-azure-portal
QUESTION 86
You have an Active Directory forest named contoso.com.
You install and configure Azure AD Connect to use password hash synchronization as the single
sign-on (SSO) method. Staging mode is enabled.
You review the synchronization results and discover that the Synchronization Service Manager
does not display any sync jobs.
You need to ensure that the synchronization completes successfully.
What should you do?
A. From Synchronization Service Manager, run a full import.

B. Run Azure AD Connect and set the SSO method to Pass-through Authentication.
C. From Azure PowerShell, run Start-AdSyncSyncCycle -PolicyType Initial.
D. Run Azure AD Connect and disable staging mode.
Answer: D
Explanation:
Staging mode must be disabled. If the Azure AD Connect server is in staging mode, password
hash synchronization is temporarily disabled.
References: https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-
aadconnectsync-troubleshoot-password-hash-synchronization#no-passwords-are-synchronized-
troubleshoot-by-using-the-troubleshooting-task
QUESTION 87
You purchase 10 Azure AD Premium P2 licenses for the tenant. You need to ensure that 10
users can use all the Azure AD Premium features.
What should you do?
A. From the Groups blade of each user, invite the users to a group.
B. From the Licenses blade of Azure AD, assign a license.
C. From the Directory role blade of each user, modify the directory role.
D. From the Azure AD domain, add an enterprise application.
Answer: B
Explanation:
To assign a license, under Azure Active Directory > Licenses > All Products, select one or more
products, and then select Assign on the command bar.
References: https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/license-users-
groups
QUESTION 88
You download an Azure Resource Manager template based on an existing virtual machine. The
template will be used to deploy 100 virtual machines. You need to modify the template to
reference an administrative password. You must prevent the password from being stored in plain
text.
What should you create to store the password?
A. Azure Active Directory (AD) Identity Protection and an Azure policy
B. a Recovery Services vault and a backup policy
C. an Azure Key Vault and an access policy
D. an Azure Storage account and an access policy
Answer: C
Explanation:
You can use a template that allows you to deploy a simple Windows VM by retrieving the
password that is stored in a Key Vault. Therefore the password is never put in plain text in the
template parameter file.
References: https://azure.microsoft.com/en-us/resources/templates/101-vm-secure-password/
QUESTION 89
correct solution.
Your company registers a domain name of contoso.com.

You create an Azure DNS named contoso.com and then you add an A record to the zone for a
host named www that has an IP address of 131.107.1.10.
You discover that Internet hosts are unable to resolve www.contoso.com to the 131.107.1.10 IP
address.
You need to resolve the name resolution issue.
Solution: You modify the name server at the domain register.
A. Yes
B. No
Answer: A
Explanation:
https://docs.microsoft.com/en-us/azure/dns/dns-delegate-domain-azure-dns
Delegate the domain
Now that the DNS zone is created and you have the name servers, you need to update the
parent domain with the Azure DNS name servers. Each registrar has its own DNS management
tools to change the name server records for a domain.
QUESTION 90
correct solution.
You create an Azure DNS zone named contoso.com, and then you add an A record to the zone
for a host named www that has an IP address of 131.107.1.10.
address.
Solution: You add an NS record to the contoso.com Azure DNS zone.
A. Yes
B. No
Answer: B
Explanation:
Default NS records are created automatically and shouldn't be messed with in this case.
QUESTION 91
correct solution.

You create an Azure DNS named contoso.com and then you add an A record to the zone for a
host named www that has an IP address of 131.107.1.10.
address.
Solution: You modify the SOA record in the contoso.com zone.
A. Yes
B. No
Answer: B
Explanation:
Modify the NS record, not the SOA record.
Note: The SOA record stores information about the name of the server that supplied the data for
the zone; the administrator of the zone; the current version of the data file; the number of seconds
a secondary name server should wait before checking for updates; the number of seconds a
secondary name server should wait before retrying a failed zone transfer; the maximum number
of seconds that a secondary name server can use data before it must either be refreshed or
expire; and a default number of seconds for the time-to-live file on resource records.
References: https://searchnetworking.techtarget.com/definition/start-of-authority-record
QUESTION 92
A. Yes
B. No
Answer: B
QUESTION 93
You receive a notification that VM1 will be affected by maintenance.
You need to move VM1 to a different host immediately.
A. Yes
B. No
Answer: B
QUESTION 94
Solution: From the Update management blade, you click enable.
A. Yes
B. No
Answer: B
Explanation:
You would need to Redeploy the VM.
node
QUESTION 95
You add contoso.com as a custom domain name to Azure AD.
You need to ensure that Azure can verify the domain name.
A. PTR
B. MX
C. NSEC3
D. RRSIG
Answer: B
QUESTION 96
You manage an Azure Windows Server virtual machine (VM) that hosts several SQL Server
databases.
You need to configure backup and retention policies for the VM. The backup policy must include
transaction log backups.
What should you do?
A. Configure point-in-time and long-term retention policies from the SQL Servers Azure portal blade.
B. Configure a SQL Server in Azure VM backup policy from the Recovery Services Azure portal
blade.
C. Configure a continuous delivery deployment group from the Virtual Machine Azure portal blade.
D. Configure a point-in-time snapshot from the Disks Azure portal blade.
Answer: B
Explanation:
You should configure a SQL Server in Azure VM backup policy from the Recovery Services
Azure portal blade.
The Azure Recovery Services vault has three default policy templates:
Azure Virtual Machine
Azure File Share
SQL Server in Azure VM
Because you need to back up both the SQL Server databases as well as transaction logs, you
should create a SQL Server in Azure VM backup policy. These policies also enable you to specify
backup retention durations at the daily, weekly, monthly, and yearly scopes.
You should not configure point-in-time and long-term retention policies from the SQL Servers
Azure portal blade. These backup and retention policies are available for the Azure SQL
Database platform-as-a-service (PaaS) offering, and not for Azure virtual machines hosting SQL
Server databases.
You should not configure a continuous delivery deployment group from the Virtual Machine Azure
portal blade. This feature is unrelated to VM backup and recovery, and allows you to integrate a
VM in a Visual Studio Team Services (VSTS) continuous integration/continuous deployment
(Cl/CD) workflow.
You should not configure a point-in-time snapshot from the Disks Azure portal blade. The
snapshot functionality in Azure does not have formal policy associated with it, nor does it back up
VM configuration.
QUESTION 97
The development team asks you to provision an Azure storage account for their use.
To remain in compliance with IT security policy, you need to ensure that the new Azure storage
account meets the following requirements:
- Data must be encrypted at rest.

- Access keys must facilitate automatic rotation.
- The company must manage the access keys.
What should you do?
A. Create a service endpoint between the storage account and a virtual network (VNet).
B. Require secure transfer for the storage account.
C. Enable Storage Service Encryption (SSE) on the storage account.
D. Configure the storage account to store its keys in Azure Key Vault.
Answer: D
Explanation:
You should configure the storage account to store its keys in Azure Key Vault. Azure Key Vault
provides a mechanism to store secrets, such as storage account keys, user credentials, and
digital certificates, securely in the Microsoft Azure cloud. You can access the underlying
Representational State Transfer (REST) application programming interface (API) to rotate or
retrieve the secrets in your source code.
You should not enable SSE on the storage account for two reasons. First, SSE is enabled
automatically on all Azure storage accounts and encrypts all storage account data at rest.
Second, SSE in its native form uses Microsoft-managed access keys, which violates the scenario
constraint for customer-managed keys.
You should not require secure transfer for the storage account. Secure transfer forces all REST
API calls to use HTTPS instead of HTTP. This feature has nothing to do with either access keys
or their management and rotation.
You should not create a service endpoint between the storage account and a VNet. A service
endpoint allows you limit traffic to a storage account from resources residing on an Azure VNet.
QUESTION 98
You have several Windows Server and Ubuntu Linux virtual machines (VMs) distributed across
two virtual networks (VNets):
- prod-vnet-west (West US region)

- prod-vnet-east (East US region)
You need to allow VMs in either VNet to connect and to share resources by using only the Azure
backbone network.
Your solution must minimize cost, complexity, and deployment time.
What should you do?
A. Add a service endpoint to each VNet.

B. Configure peering between prod-vnet-west and prod-vnet-west.
C. Create a private zone in Azure DNS.
D. Deploy a VNet-to-VNet virtual private network (VPN).
Answer: B
Explanation:
You should configure peering between prod-vnet-west and prod-vnet-west. Peering enables VMs
located on two different Azure VNets to be grouped logically together and thereby connect and
share resources. Traditional VNet peering involves two VNets located in the same region.
However, global VNet peering, generally available in summer 2018, supports VNets distributed
across any Azure public region.
You should not deploy a VNet-to-VNet VPN. First, global VNet peering means that you are no
longer required to use a VPN gateway to link VNets located in different Azure regions. Second,
the scenario requires that you minimize cost and complexity.
You should not create a private zone in Azure DNS. This action would be necessary for
resources in peered VNets to resolve each other's DNS host names. However, the scenario
makes no requirement for private host name resolution.
You should not add a service endpoint to each VNet. Service endpoints allow you to limit access
to certain Azure resources, such as storage accounts and Azure SQL databases, to resources
located on a single VNet. Thus, this feature cannot be used to link two VNets as the scenario
mandates.
QUESTION 99
Your company's local environment consists of a single Active Directory Domain Services (AD DS)
domain.
You plan to offer your users single sign-on (SSO) access to Azure-hosted software-as-a-service
(SaaS) applications that use Azure Active Directory (Azure AD) authentication.
The tenant's current domain name is companycom.onmicrosoft.com.
You need to configure Azure AD to use company.com, the organization's owned public domain
name.
What should you do?
A. Add a company.com user principal name (UPN) suffix to the AD DS domain.

B. Run Azure AD Connect from a domain member server and specify the custom installation option.
C. Remove the companycom.onmicrosoft.com domain name from the Azure AD tenant.
D. Add a DNS verification record at the domain registrar.
Answer: D
Explanation:
You should add a Domain Name System (DNS) verification record at the domain registrar. This
step is required to verify to Microsoft that you own the public DNS domain name in question. You
perform the validation by creating either a text (TXT) or mail exchanger (MX) record in your DNS
zone file at the registrar's website, using Microsoft-provided values. You can delete the
verification record after Azure validates the domain for use with Azure AD.
You should not remove the companycom.onmicrosoft.com domain name from the Azure AD
tenant. In fact, you cannot remove this domain name because Azure uses it to identify your
directory uniquely across the entire Microsoft Azure global ecosystem.
You should not add a company.com user principal name (UPN) suffix to the AD DS domain. If
you use a non-routable DNS domain in AD DS, then you may indeed be required to perform this
action. However, the scenario does not specify what AD DS domain name is currently defined.
You should not run Azure AD Connect from a domain member server and specify the custom
installation option. Configuring the proper public and private DNS domain names is one of the
prerequisite steps that needs to be completed before you run the Azure AD Connect wizard for
the first time.
QUESTION 100
You have an Azure subscription that contains a storage account.

You have an on-premises server named Server1 that runs Window Server 2016.
Server1 has 2 TB of data.
You need to transfer the data to the storage account by using the Azure Import/Export service.
In which order should you perform the actions? To answer, move all actions from the list of
actions to the answer area and arrange them in the correct order.
NOTE: More than one order of answer choices is correct. You will receive credit for any of the
correct orders you select.
Answer:
Explanation:
At a high level, an import job involves the following steps:
Step 1: Attach an external disk to Server1 and then run waimportexport.exe
Determine data to be imported, number of drives you need, destination blob location for your data
in Azure storage.
Use the WAImportExport tool to copy data to disk drives. Encrypt the disk drives with BitLocker.
Step 2: From the Azure portal, create an import job.
Create an import job in your target storage account in Azure portal. Upload the drive journal files.
Step 3: Detach the external disks from Server1 and ship the disks to an Azure data center.
Provide the return address and carrier account number for shipping the drives back to you.
Ship the disk drives to the shipping address provided during job creation.
Step 4: From the Azure portal, update the import job
Update the delivery tracking number in the import job details and submit the import job.
The drives are received and processed at the Azure data center.
The drives are shipped using your carrier account to the return address provided in the import
job.
References:
https://docs.microsoft.com/en-us/azure/storage/common/storage-import-export-service
QUESTION 101
Hotspot Question

You create a shared access signature (SAS) named SAS1 as shown in the following exhibit.
Answer:
Explanation:
References:
https://docs.microsoft.com/en-us/azure/storage/common/storage-dotnet-shared-access-
signature-part-1
https://docs.microsoft.com/en-us/azure/vs-azure-tools-storage-manage-with-storage-
explorer?tabs=windows
QUESTION 102
Answer:
Explanation:
The Azure File Sync agent is a downloadable package that enables Windows Server to be
synced with an Azure file share
registered server.
References: https://docs.microsoft.com/en-us/azure/storage/files/storage-sync-files-deployment-
guide
QUESTION 103
Hotspot Question
You plan to create an Azure Storage account in the Azure region of East US 2.
You need to create a storage account that meets the following requirements:
- Replicates synchronously
- Remains available if a single data center in the region fails.
How should you configure the storage account? To answer, select the appropriate options in the
answer area.
Answer:
Explanation:
Box 1: Zone-redundant storage (ZRS)
Zone-redundant storage (ZRS) replicates your data synchronously across three storage clusters
in a single region.
LRS would not remain available if a data center in the region fails GRS and RA GRS use
asynchronous replication.
Box 2: StorageV2 (general purpose V2)
ZRS only support GPv2.
References:
https://docs.microsoft.com/en-us/azure/storage/common/storage-redundancy
https://docs.microsoft.com/en-us/azure/storage/common/storage-redundancy-zrs
QUESTION 104

You create an Azure Storage account named contosostorage, and then you create a file share
named data.
answer, drag the appropriate values to the correct targets. Each value may be used once, more
than once, or not at all. You may need to drag the split bar between panes or scroll to view
content.
Answer:
Explanation:
The name of account
Box 3: data
Example:
References: https://docs.microsoft.com/en-us/azure/storage/files/storage-how-to-use-files-
windows
QUESTION 105
Hotspot Question
You have an Azure Storage accounts as shown in the following exhibit.
Answer:
Explanation:
Box 1: storageaccount1 and storageaccount2 only
Box 2: All the storage accounts
Note: The three different storage account options are: General-purpose v2 (GPv2) accounts,
General-purpose v1 (GPv1) accounts, and Blob storage accounts. General-purpose v2 (GPv2)
accounts are storage accounts that support all of the latest features for blobs, files, queues, and
tables.
Blob storage accounts support all the same block blob features as GPv2, but are limited to
supporting only block blobs.
General-purpose v1 (GPv1) accounts provide access to all Azure Storage services, but may not
have the latest features or the lowest per gigabyte pricing.
References: https://docs.microsoft.com/en-us/azure/storage/common/storage-account-options
QUESTION 106
You have an Azure subscription that contains an Azure virtual machine named VM1.
VM1 runs Windows Server 2016 and is part of an availability set.
VM1 has virtual machine-level backup enabled.
VM1 is deleted.
You need to restore VM1 from the backup. VM1 must be part of the availability set.
Answer:
QUESTION 107
Hotspot Question

You plan to deploy an Ubuntu Server virtual machine named VM1 to Subscription1.
You need to perform a custom deployment of the virtual machine.
A specific trusted root certification authority (CA) must be added during the deployment.
What should you do? To answer, select the appropriate options in the answer area.
Answer:
Explanation:
Box 1: Cloud-init.txt
Cloud-init.txt is used to customize a Linux VM on first boot up. It can be used to install packages
and write files, or to configure users and security. No additional steps or agents are required to
apply your configuration.
Box 2: The az vm create command
Once Cloud-init.txt has been created, you can deploy the VM with az vm create cmdlet, sing the -
-custom-data parameter to provide the full path to the cloud-init.txt file.
References:
https://docs.microsoft.com/en-us/azure/virtual-machines/linux/tutorial-automate-vm-deployment
QUESTION 108
Hotspot Question
You have an Azure subscription named Subscription1. Subscription1 contains two Azure virtual
machines named VM1 and VM2.
VM1 and VM2 run Windows Server 2016. VM1 is backed up daily by Azure Backup without using
the Azure Backup agent.
VM1 is affected by ransomware that encrypts data.
You need to restore the latest backup of VM1.
To which location can you restore the backup? To answer, select the appropriate options in the
answer area.
Answer:
Explanation:
Box 1: VM1 only
To restore files or folders from the recovery point, go to the virtual machine and choose the
desired recovery point.
Box 2: A new Azure virtual machine only
On the Restore configuration blade, you have two choices:
Create virtual machine
Restore disks
References:
https://docs.microsoft.com/en-us/azure/backup/backup-azure-restore-files-from-vm
https://docs.microsoft.com/en-us/azure/backup/backup-azure-arm-restore-vms
QUESTION 109
Hotspot Question
You purchase a new Azure subscription named Subscription1.

You create a virtual machine named VM1 in Subscription1.
VM1 is not protected by Azure Backup.
You need to protect VM1 by using Azure Backup. Backups must be created at 01:00 and stored
for 30 days.
Answer:
Explanation:
Box 1: A Recovery Services vault
A Recovery Services vault is an entity that stores all the backups and recovery points you create
over time.
Box 2: A backup policy
What happens when I change my backup policy?
When a new policy is applied, schedule and retention of the new policy is followed.
References:
https://docs.microsoft.com/en-us/azure/backup/backup-configure-vault
https://docs.microsoft.com/en-us/azure/backup/backup-azure-backup-faq
QUESTION 110
You have an availability set named AS1 that contains three virtual machines named VM1, VM2,
and VM3.
You attempt to reconfigure VM1 to use a larger size. The operation fails and you receive an
allocation failure message.
You need to ensure that the resize operation succeeds.
Answer:
QUESTION 111
You have an Azure subscription. The subscription includes a virtual network named VNet1.
Currently, VNet1 does not contain any subnets.
You plan to create subnets on VNet1 and to use application security groups to restrict the traffic
between the subnets.
You need to create the application security groups and to assign them to the subnets.
Which four cmdlets should you run in sequence? To answer, move the appropriate cmdlets from
the list of cmdlets to the answer area and arrange them in the correct order.
Answer:
QUESTION 112
Hotspot Question
Subscription1 contains the virtual machines in the following table.
Subscription1 contains a virtual network named VNet1 that has the subnets in the following table.
VM3 has a network adapter named NIC3. IP forwarding is enabled on NIC3. Routing is enabled
on VM3.
You create a route table named RT1. RT1 is associated to Subnet1 and Subnet2 and contains
the routes in the following table.
You apply RT1 to Subnet1.

Answer:
Explanation:
Box 1: Yes
Traffic from VM1 and VM2 can reach VM3 thanks to the routing table, and as IP forwarding is
enabled on VM3, traffic from VM3 can reach VM1.
Box 2: No
VM3, which has IP forwarding, must be turned on, in order for traffic from VM2 to reach VM1.
Box 3: Yes
The traffic from VM1 will reach VM3, which thanks to IP forwarding, will send the traffic to VM2.
References: https://www.quor
a.com/What-is-IP-forwarding
QUESTION 113
Hotspot Question
You plan to deploy five virtual machines to a virtual network subnet. Each virtual machine will
have a public IP address and a private IP address.
Each virtual machine requires the same inbound and outbound security rules.
What is the minimum number of network interfaces and network security groups that you require?
Answer:
Explanation:
Box 1: 5
A NIC can only be attached to a single VM, thus 5 are necessary.
Box 2: 1
A NSG can be assigned to zero or more NICs or Subnets; since the rules need to be the same,
only one NSG rule set is needed, which will be applied to each NIC.
QUESTION 114
Hotspot Question
You have an Azure subscription named Subscription1. Subscription1 contains the resources in
In Azure, you create a private DNS zone named adatum.com.

You set the registration virtual network to VNet2. The adatum.com zone is configured as shown in
the following exhibit.
Answer:
Explanation:
Box 1: No
Box 2: No
Forward DNS resolution is supported across virtual networks that are linked to the private zone
as resolution virtual networks. VM5 does belong to a resolution virtual network.
Box 3: Yes
VM6 belongs to registration virtual network, and an A (Host) record exists for VM9 in the DNS
zone. By default, registration virtual networks also act as resolution virtual networks, in the sense
that DNS resolution against the zone works from any of the virtual machines within the
registration virtual network.
References: https://docs.microsoft.com/en-us/azure/dns/private-dns-overview
QUESTION 115
Hotspot Question
named VM1.
VM1 has the effective network security rules shown in the following exhibit.
Answer:
Explanation:
Box 1:
Rule2 blocks ports 50-60, which includes port 53, the DNS port. Internet users can reach the Web
server, since it uses port 80.
Box 2:
If Rule2 is removed internet users can reach the DNS server as well.
Note: Rules are processed in priority order, with lower numbers processed before higher
numbers, because lower numbers have higher priority. Once traffic matches a rule, processing
stops. As a result, any rules that exist with lower priorities (higher numbers) that have the same
attributes as rules with higher priorities are not processed.
References:
QUESTION 116
Hotspot Question
You have peering configured as shown in the following exhibit.
Answer:
Explanation:
https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-manage-
peering#requirements-and-constraints
QUESTION 117
Hotspot Question
You have an Azure subscription named Subscription1. Subscription1 contains the virtual
networks in the following table.
The firewalls on all the virtual machines are configured to allow all ICMP traffic.
You add the peerings in the following table.
Answer:
Explanation:
A bidirectional link must be created in order to establish a successful connection.
For example, to peer VNet A to VNet B, a link must be created from VNetA to VNetB and from
VNetB to VNetA. Creating both links will change the state to Connected.
https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-faq#my-vnet-peering-
connection-is-in-initiated-state-why-cant-i-connect
QUESTION 118
You have an Azure Active Directory (Azure AD) tenant that has the initial domain name.
You have a domain name of contoso.com registered at a third-party registrar. You need to ensure
that you can create Azure AD users that have names containing a suffix of @contoso.com.
Which three actions should you perform in sequence? To answer, move the appropriate cmdlets
from the list of cmdlets to the answer area and arrange them in the correct order.
Answer:
Explanation:
The process is simple:
Add the custom domain name to your directory
Add a DNS entry for the domain name at the domain name registrar Verify the custom domain
name in Azure AD
References: https://docs.microsoft.com/en-us/azure/dns/dns-web-sites-custom-domain
QUESTION 119
Hotspot Question

Subscription1 contains the resources in the following table.
VNet1 is in RG1. VNet2 is in RG2. There is no connectivity between VNet1 and Vnet2.
An administrator named Admin1 creates an Azure virtual machine named VM1 in RG1.
M1 uses a disk named Disk1 and connects to VNet1. Admin1 then installs a custom application in
VM1.
You need to move the custom application to Vnet2.
The solution must minimize administrative effort.
Which two actions should you perform? To answer, select the appropriate options in the answer
area.
Answer:
Explanation:
We cannot just move a virtual machine between networks. What we need to do is identify the disk
used by the VM, delete the VM itself while retaining the disk, and recreate the VM in the target
virtual network and then attach the original disk to it.
https://blogs.technet.microsoft.com/canitpro/2014/06/16/step-by-step-move-a-vm-to-a-different-
vnet-on-azure/
https://4sysops.com/archives/move-an-azure-vm-to-another-virtual-network-vnet/#migrate-an-
azure-vm-between-vnets
QUESTION 120
Hotspot Question
You have an Azure Active Directory (Azure AD) tenant named adatum.com. Adatum.com
contains the groups in the following table.
You create two user accounts that are configured as shown in the following table.
To which groups do User1 and User2 belong? To answer. select the appropriate options in the
answer area.
Answer:
Explanation:
https://docs.microsoft.com/en-us/sccm/core/clients/manage/collections/create-collections
QUESTION 121
machines.
A. Idle Time-out (minutes) to 20

B. Floating IP (direct server return) to Disabled
C. Floating IP (direct server return) to Enabled
D. Session persistence to Client IP and protocol
Answer: D
Explanation:
You can set the sticky session in load balancer rules with setting the session persistence as the
client IP and protocol. Client IP and Protocol specifies that successive requests from the same
client IP address and protocol combinations will be handles by the same VM.
References:
https://cloudopszone.com/configure-azure-load-balancer-for-sticky-sessions
QUESTION 122
You are the global administrator for an Azure Active Directory (Azure AD) tenant named
adatum.com.
You need to enable two-step verification for Azure users.
What should you do?
A. Configure a playbook in Azure AD conditional access policy.

B. Create an Azure AD conditional access policy.
C. Create and configure the Identify Hub.
D. Install and configure Azure AD Connect.
Answer: B
Explanation:
https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-mfasettings
QUESTION 123
From the MFA Server blade, you open the Block/unblock users blade as shown in the exhibit.
What caused AlexW to be blocked?
A. The user entered an incorrect PIN four times within 10 minutes.

B. The user account password expired.
C. An administrator manually blocked the user.
D. The user reported a fraud alert when prompted for additional authentication.
Answer: C
Explanation:
Only an admin can block users and not a reason and complaints in terms of the software way of
working.
QUESTION 124
You have the Azure virtual networks shown in the following table.
To which virtual networks can you establish a peering connection from VNet1?
A. VNet2 and VNet3 only
B. VNet2 only
C. VNet3 and VNet4 only
D. VNet2, VNet3, and VNet4
Answer: C
Explanation:
The virtual networks you peer must have non-overlapping IP address spaces. The VNet1 and
VNhet2 address spaces overlap. The range of VNet2 is contained inside the range of VNet1.
References:
QUESTION 125
machine named VM1.
VNet2 contains an Azure virtual machine named VM2. VM1 hosts a frontend application that
connects to VM2 to retrieve data. Users report that the frontend application is slower than usual.
A. NSG flow logs

C. IP flow verify
D. Connection monitor
Answer: D
Explanation:
The Connection Monitor feature in Azure Network Watcher is now generally available in all public
regions. Connection Monitor provides you RTT values on a per-minute granularity. You can
monitor a direct TCP connection from a virtual machine to a virtual machine, FQDN, URI, or IPv4
address.
References:
https://azure.microsoft.com/en-us/updates/general-availability-azure-network-watcher-connection-
monitor-in-all-public-regions/
QUESTION 126
You are troubleshooting a performance issue for an Azure Application Gateway.
You need to compare the total requests to the failed requests during the past six hours.
A. Metrics in Application Gateway

B. Diagnostics logs in Application Gateway
C. NSG flow logs in Azure Network Watcher
D. Connection monitor in Azure Network Watcher
Answer: A
Explanation:
Application Gateway currently has seven metrics to view performance counters. Metrics are a
feature for certain Azure resources where you can view performance counters in the portal. For
Application Gateway, the following metrics are available:
Total Requests
Failed Requests
Current Connections
Healthy Host Count
Response Status
Throughput
Unhealthy Host count
You can filter on a per backend pool basis to show healthy/unhealthy hosts in a specific backend
pool
References: https://docs.microsoft.com/en-us/azure/application-gateway/application-
gatewaydiagnostics#Metrics
QUESTION 127
You have two Azure virtual machines named VM1 and VM2. VM1 has a single data disk named
Disk1.
You need to attach Disk1 to VM2. The solution must minimize downtime for both virtual
machines.
Which four actions should you perform in sequence? To answer, move the appropriate actions
Answer:
Explanation:
Explanation:
Step 1: Stop VM1.
Step 2: Detach Disk1 from VM1.
Step 3: Start VM1.
Detach a data disk using the portal
1. In the left menu, select Virtual Machines.
2. Select the virtual machine that has the data disk you want to detach and click Stop to
deallocate the VM.
3. In the virtual machine pane, select Disks.
4. At the top of the Disks pane, select Edit.
5. In the Disks pane, to the far right of the data disk that you would like to detach, click the Detach
button image detach button.
6. After the disk has been removed, click Save on the top of the pane.
7. In the virtual machine pane, click Overview and then click the Start button at the top of the
pane to restart the VM.
8. The disk stays in storage but is no longer attached to a virtual machine.
Step 4: Attach Disk1 to VM2 -
Attach an existing disk -
Follow these steps to reattach an existing available data disk to a running VM.
1. Select a running VM for which you want to reattach a data disk.
2. From the menu on the left, select Disks.
3. Select Attach existing to attach an available data disk to the VM.
4. From the Attach existing disk pane, select OK.
References:
https://docs.microsoft.com/en-us/azure/virtual-machines/windows/detach-disk
https://docs.microsoft.com/en-us/azure/lab-services/devtest-lab-attach-detach-data-disk
QUESTION 128
You have an Azure subscription that is used by four departments in your company.
The subscription contains 10 resource groups. Each department uses resources in several
resource groups.
You need to send a report to the finance department.
The report must detail the costs for each department.
Answer:
Explanation:
Box 1: Assign a tag to each resource.
You apply tags to your Azure resources giving metadata to logically organize them into a
taxonomy. After you apply tags, you can retrieve all the resources in your subscription with that
tag name and value. Each resource or resource group can have a maximum of 15 tag
name/value pairs. Tags applied to the resource group are not inherited by the resources in that
resource group.
Box 2: From the Cost analysis blade, filter the view by tag After you get your services running,
regularly check how much they're costing you. You can see the current spend and burn rate in
Azure portal.
Visit the Subscriptions blade in Azure portal and select a subscription. You should see the cost
breakdown and burn rate in the popup blade. Click Cost analysis in the list to the left to see the
cost breakdown by resource. Wait 24 hours after you add a service for the data to populate.
You can filter by different properties like tags, resource group, and timespan. Click Apply to
confirm the filters and Download if you want to export the view to a Comma-Separated Values
(.csv) file.
Box 3: Download the usage report
References:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-using-tags
https://docs.microsoft.com/en-us/azure/billing/billing-getting-started
QUESTION 129
Hotspot Question
You have a virtual network named VNet1 that has the configuration shown in the following exhibit.
Answer:
Explanation:
As 192.168.1.0/24 is outside of the configured address space of 10.2.0.0/16, the answer is to
create an address space.
As 10.2.1.0/24 subnet doesn’t exist (only 10.2.0.0/24) the answer is to create a subnet.
QUESTION 130
Hotspot Question
You have an Azure subscription named Subscrption1 that is associated to an Azure Active
Directory (Azure AD) tenant named AAD1.
Subscription1 contains the objects in the following table:
You plan to create a single backup policy for Vault1. To answer, select the appropriate options in
the answer area.
Answer:
Explanation:
Box 1: Share1 only
Azure Backup policies can only back up an Azure VM, SQL in an Azure VM or File Share. As
such the answer to the first part should be Share1 only.
Box 2: 99 years
With the latest update to Azure Backup, customers can retain their data for up to 99 years in
Azure.
Note: A backup policy defines a matrix of when the data snapshots are taken, and how long those
snapshots are retained.
The backup policy interface looks like this:
References: https://docs.microsoft.com/en-us/azure/backup/backup-azure-vms-first-look-
arm#defining-a-backup-policy
https://blogs.microsoft.com/firehose/2015/02/16/february-update-to-azure-backup-includes-data-
retention-up-to-99-years-offline-backup-and-more/
QUESTION 131
You have an Azure Linux virtual machine that is protected by Azure Backup.
One week ago, two files were deleted from the virtual machine.
You need to restore the deleted files to an on-premises computer as quickly as possible.
Answer:
Explanation:
To restore files or folders from the recovery point, go to the virtual machine and choose the
desired recovery point.
Step 0. In the virtual machine's menu, click Backup to open the Backup dashboard. Step 1. In the
Backup dashboard menu, click File Recovery.
Step 2. From the Select recovery point drop-down menu, select the recovery point that holds the
files you want. By default, the latest recovery point is already selected.
Step 3: To download the software used to copy files from the recovery point, click Download
Executable (for Windows Azure VM) or Download Script (for Linux Azure VM, a python script is
generated).
Step 4: Copy the files by using AzCopy
AzCopy is a command-line utility designed for copying data to/from Microsoft Azure Blob, File,
and Table storage, using simple commands designed for optimal performance.
You can copy data between a file system and a storage account, or between storage accounts.
References:
https://docs.microsoft.com/en-us/azure/storage/common/storage-use-azcopy
QUESTION 132
Hotspot Question
You have an Azure Migrate project that has the following assessment properties:
Target location: East US

Storage redundancy: Locally redundant.
Comfort factor: 2.0
Performance history: 1 month
Percentile utilization: 95th
Pricing tier: Standard
Offer: Pay as you go
You discover the following two virtual machines:
A virtual machine named VM1 that runs Windows Server 2016 and has 10
CPU cores at 20 percent utilization
A virtual machine named VM2 that runs Windows Server 2012 and has four
CPU cores at 50 percent utilization
How many CPU cores will Azure Migrate recommend for each virtual machine? To answer, select
the appropriate options in the answer area.
Answer:
Explanation:
Box 2: 4
4 *0.50 * 0.95* 2 = 3.8
Note: The number of cores in the machines must be equal to or less than the maximum number
of cores (128 cores) supported for an Azure VM.
If performance history is available, Azure Migrate considers the utilized cores for comparison. If a
comfort factor is specified in the assessment settings, the number of utilized cores is multiplied by
the comfort factor.
If there's no performance history, Azure Migrate uses the allocated cores, without applying the
comfort factor.
References:
https://docs.microsoft.com/en-us/azure/migrate/concepts-assessment-calculation
QUESTION 133
Hotspot Question
You have an Azure subscription named Subscroption1.

In Subscription1, you create an alert rule named Alert1. The Alert1 action group is configured as
shown in the following exhibit.
Alert1 alert criteria is triggered every minute.
Answer:
Explanation:
Box 1: 60
One alert per minute will trigger one email per minute.
Box 2: 12
No more than 1 SMS every 5 minutes can be send, which equals 12 per hour. Note: Rate limiting
is a suspension of notifications that occurs when too many are sent to a particular phone number,
email address or device. Rate limiting ensures that alerts are manageable and actionable.
The rate limit thresholds are:
SMS: No more than 1 SMS every 5 minutes.
Voice: No more than 1 Voice call every 5 minutes.
Email: No more than 100 emails in an hour.
Other actions are not rate limited.
References:
https://github.com/MicrosoftDocs/azure-docs/blob/master/articles/monitoring-and-
diagnostics/monitoring-overview-alerts.md
QUESTION 134
Hotspot Question

You have a virtualization environment that contains the virtualization servers in the following
table.
The virtual machines are configured as shown in the following table.
All the virtual machines use basic disks. VM1 is protected by using BitLocker Drive Encryption
(BitLocker).
You plan to use Azure Site Recovery to migrate the virtual machines to Azure. Which virtual
machines can you migrate? To answer, select the appropriate options in the answer area.
Answer:
Explanation:
Box 1: VM3
Not VM1 as Bitlocker is not supported. BitLocker must be disabled before you enable replication
for a VM.
Not VM2 as maximum Operating system disk size for a generation VM is 2,048 GB.
Box 2: VMA and VMB only
Not VMC as the max data disk size is 4,095 GB
References:
https://docs.microsoft.com/en-us/azure/site-recovery/hyper-v-azure-support-matrix
https://docs.microsoft.com/en-us/azure/site-recovery/vmware-physical-azure-support-
matrix#azure-vm-requirements
QUESTION 135
Your network is configured as shown in the following exhibit.
The firewalls are configured as shown in the following table.
Prod1 contains a vCenter server.
You install an Azure Migrate Collector on Test1.
You need to discover the virtual machines.
Which TCP port should be allowed on each firewall? To answer, drag the appropriate ports to the
correct firewalls. Each port may be used once, more than once, or not at all. You may need to
drag the split bar between panes or scroll to view content.
Answer:
Explanation:
FW1: Outbound 443
Collector communicates with Azure Migrate service over SSL 443.
FW2: Outbound 443
The Collector must be able to communicate with the vCenter Server. By default, it connects to
vCenter on 443.
Note: The collector communicates as summarized in the following diagram.
References:
https://docs.microsoft.com/en-us/azure/migrate/concepts-collector
QUESTION 136
You have an on-premises network that includes a Microsoft SQL Server instance named SQL1.
You create an Azure Logic App named App1.
You need to ensure that App1 can query a database on SQL1.
Answer:
Explanation:
To access data sources on premises from your logic apps, you can create a data gateway
resource in Azure so that your logic apps can use the on-premises connectors. Box 1: From an
on-premises computer, install an on-premises data gateway. Before you can connect to on-
premises data sources from Azure Logic Apps, download and install the on-premises data
gateway on a local computer.
Box 2: From the Azure portal, create an on-premises data gateway Create Azure resource for
gateway
After you install the gateway on a local computer, you can then create an Azure resource for your
gateway. This step also associates your gateway resource with your Azure subscription. Sign in
to the Azure portal. Make sure you use the same Azure work or school email address used to
install the gateway.
On the main Azure menu, select Create a resource > Integration > On-premises data gateway.
On the Create connection gateway page, provide this information for your gateway resource. To
add the gateway resource to your Azure dashboard, select Pin to dashboard. When you're done,
choose Create.
Box 3: From the Logic Apps Designer in the Azure portal, add a connector After you create your
gateway resource and associate your Azure subscription with this resource, you can now create a
connection between your logic app and your on-premises data source by using the gateway.
In the Azure portal, create or open your logic app in the Logic App Designer. Add a connector that
supports on-premises connections, for example, SQL Server.
Set up your connection.
References:
https://docs.microsoft.com/en-us/azure/logic-apps/logic-apps-gateway-connection
QUESTION 137
Hotspot Question
You have an Azure Active Directory (Azure AD) tenant.

You need to create a conditional access policy that requires all users to use multi-factor
authentication when they access the Azure portal.
Which three settings should you configure? To answer, select the appropriate settings in the
answer area.
Answer:
Explanation:
Box 1: Assignments, Users and Groups
When you configure the sign-in risk policy, you need to set:
The users and groups the policy applies to: Select Individuals and Groups
Box 2:
When you configure the sign-in risk policy, you need to set the type of access you want to be
enforced.
Box 3:
When you configure the sign-in risk policy, you need to set:
The type of access you want to be enforced when your sign-in risk level has been met:
References:
https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/howto-user-risk-policy
QUESTION 138
Hotspot Question
You plan to use Azure Network Watcher to perform the following tasks:
Task1: Identify a security rule that prevents a network packet from reaching an Azure virtual
machine.
Task2: Validate outbound connectivity from an Azure virtual machine to an external host.
Which feature should you use for each task? To answer, select the appropriate options in the
answer area.
Answer:
Explanation:
Task 1: IP flow verify
IP flow verify checks if a packet is allowed or denied to or from a virtual machine. The information
consists of direction, protocol, local IP, remote IP, local port, and remote port. If the packet is
denied by a security group, the name of the rule that denied the packet is returned. While any
source or destination IP can be chosen, IP flow verify helps administrators quickly diagnose
connectivity issues from or to the internet and from or to the on-premises environment.
Task 2:
With the addition of Connection Troubleshoot, Network Watcher will see an incremental increase
in its capabilities and ways for you to utilize it in your day to day operations. You can now, for
example, check connectivity between source (VM) and destination (VM, URI, FQDN, IP Address).
References:
https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-ip-flow-verify-overview
https://azure.microsoft.com/en-us/blog/network-watcher-connection-troubleshoot-now-generally-
available/
QUESTION 139
You have an Azure tenant that contains two subscriptions named Subscription1 and
Subscription2.
In Subscription1, you deploy a virtual machine named Server1 that runs Windows Server 2016.
Server1 uses managed disks.
You need to move Server1 to Subscription2. The solution must minimize administration effort.
A. In Subscription2, create a copy of the virtual disk.
B. From Azure PowerShell, run the Move-AzureRmResource cmdlet.
C. Create a snapshot of the virtual disk.
D. Create a new virtual machine in Subscription2.
Answer: B
Explanation:
To move existing resources to another resource group or subscription, use the Move-
AzureRmResource cmdlet.
https://docs.microsoft.com/en-in/azure/azure-resource-manager/resource-group-move-
resources#move-resources
QUESTION 140
You have an Azure subscription that contains a resource group named RG1. RG1 contains 100
virtual machines.
Your company has three cost centers named Manufacturing, Sales, and Finance.
You need to associate each virtual machine to a specific cost center.
What should you do?
A. Add an extension to the virtual machines.

B. Modify the inventory settings of the virtual machine.
C. Assign tags to the virtual machines.
D. Configure locks for the virtual machine.
Answer: C
Explanation:
QUESTION 141
You have an Azure policy as shown in the following exhibit.
Which of the following statements are true?
A. You can create Azure SQL servers in ContosoRG1.

B. You are prevented from creating Azure SQL servers anywhere in Subscription 1.
Answer: A
Explanation:
You are prevented from creating Azure SQL servers anywhere in Subscription 1 with the
exception of ContosoRG1
QUESTION 142
SIMULATION
Overview
The following section of the exam is a lab. In this section, you will perform a set of tasks in a live
environment. While most functionality will be available to you as it would be in a live environment,
some functionality (e.g., copy and paste, ability to navigate to external websites) will not be
possible by design.
Scoring is based on the outcome of performing the tasks stated in the lab. In other words, it
doesn’t matter how you accomplish the task, if you successfully perform it, you will earn credit for
that task.
Labs are not timed separately, and this exam may have more than one lab that you must
complete. You can use as much time as you would like to complete each lab. But, you should
manage your time appropriately to ensure that you are able to complete the lab(s) and all other
sections of the exam in the time provided.
Please note that once you submit your work by clicking the Next button within a lab, you will NOT
be able to return to the lab.
To start the lab

You may start the lab by clicking the Next button.
You plan to connect several virtual machines to the VNET01-USEA2 virtual network.
In the Web-RGlod8095859 resource group, you need to create a virtual machine that uses the
Standard_B2ms size named Web01 that runs Windows Server 2016. Web01 must be added to
an availability set.
What should you do from the Azure portal?
A. See below explanation
Answer: A
Explanation:
Step 1. Choose Create a resource in the upper left-hand corner of the Azure portal.
Step 2. In the Basics tab, under Project details, make sure the correct subscription is selected
and then choose Web-RGlod8095859 resource group
Step 3. Under Instance details type/select:

Virtual machine name: Web01
Image: Windows Server 2016
Size: Standard_B2ms size
Leave the other defaults.
Step 4. Finish the Wizard
Note: You will have option to create Availability Set and VNET when you create a new VM
through Azure Portal Wizard.
QUESTION 143
You have 5 TB of data that you need to transfer to Subscription.
You plan to use an Azure Import/Export job.
What can you use as the destination of the imported data?
A. Azure SQL Database

B. Azure Data Factory
C. A virtual machine
D. Azure Blob storage
Answer: D
Explanation:
QUESTION 144
SIMULATION
Overview
possible by design.
that task.
To start the lab

You plan to prevent users from accidentally deleting blob data from Azure.
You need to ensure that administrators can recover any blob data that is deleted accidentally
from the storagelod8095859 storage account for 14 days after the deletion occurred.
Answer: A
Explanation:
Task A: Create a Recovery Services vault (if a vault already exists skip this task, go to Task B
below)
A1. From Azure Portal, On the Hub menu, click All services and in the list of resources, type
Recovery Services and click Recovery Services vaults.
If there are recovery services vaults in the subscription, the vaults are listed.
A2. On the Recovery Services vaults menu, click Add.
A3. The Recovery Services vault blade opens, prompting you to provide a Name, Subscription,
Resource group, and Location
Task B. Create a backup goal

B1. On the Recovery Services vault blade (for the vault you just created), in the Getting Started
section, click Backup, then on the Getting Started with Backup blade, select Backup goal.
The Backup Goal blade opens. If the Recovery Services vault has been previously configured,
then the Backup Goal blades opens when you click Backup on the Recovery Services vault
blade.
B2. From the Where is your workload running? drop-down menu, select Azure.
B3. From the What do you want to backup? menu, select Blob Storage, and click OK.
B4. Finish the Wizard.
Task C. create a backup schedule

C1. Open the Microsoft Azure Backup agent. You can find it by searching your machine for
Microsoft Azure Backup.
C2. In the Backup agent's Actions pane, click Schedule Backup to launch the Schedule Backup
Wizard.
C3. On the Getting started page of the Schedule Backup Wizard, click Next.
C4. On the Select Items to Backup page, click Add Items.
The Select Items dialog opens.
C5. Select Blob Storage you want to protect, and then click OK.
C6.In the Select Items to Backup page, click Next.

On the Specify Backup Schedule page, specify Schedule a backup every day, and click Next.
C7. On the Select Retention Policy page, set it to 14 days, and click Next.
C8. Finish the Wizard.
References:
QUESTION 145
SIMULATION
Overview
possible by design.
that task.
To start the lab

Your company plans to store several documents on a public website.
You need to create a container named bios that will host the documents in the
storagelod8095859 storage account. The solution must ensure anonymous access and must
ensure that users can browse folders in the container.
Answer: A
Explanation:
Azure portal create public container
To create a container in the Azure portal, follow these steps:
Step 1. Navigate to your new storage account in the Azure portal.
Step 2. In the left menu for the storage account, scroll to the lob service section, then select
Blobs.
Select the + Container button.
Type a name for your new container: bios
Set the level of public access to the container: Select anonymous access.
Step 3. Select OK to create the container.
References:
https://docs.microsoft.com/en-us/azure/storage/blobs/storage-quickstart-blobs-portal
QUESTION 146
SIMULATION
Overview
possible by design.
that task.
To start the lab

Your company plans to host in Azure the source files of several line-of-business applications.
You need to create an Azure file share named corpsoftware in the storagelod8095859 storage
account. The solution must ensure the corpsoftware can store only up to 250 GB of data.
Answer: A
Explanation:
Step 1. Go to the Storage Account blade on the Azure portal:
Step 2. Click on add File Share button:
Step 3. Provide Name (storagelod8095859) and Quota (250 GB).
References:
https://docs.microsoft.com/en-us/azure/storage/files/storage-how-to-create-file-share
QUESTION 147
You need to identify unattached disks that can be deleted.
What should you do?
A. From Microsoft Azure Storage Explorer, view the Account Management properties.
B. From the Azure portal, configure the Advisor recommendations.
C. From Azure Cost Management, open the Optimizer tab and create a report.
D. From Azure Cost Management, create a Cost Management report.
Answer: A
Explanation:
https://cloud.netapp.com/blog/reduce-azure-storage-costs
QUESTION 148
correct solution.
Solution: From the Overview blade, you move the virtual machine to a different subscription.
A. Yes
B. No
Answer: B
Explanation:
You would need to Redeploy the VM.
References:
https://docs.microsoft.com/en-us/azure/virtual-machines/windows/redeploy-to-new-node
QUESTION 149
You plan to back up an Azure virtual machine named VM1.
You discover that the Backup Pre-Check status displays a status of Warning.
What is a possible cause of the Warning status?
A. VM1 does not have the latest version of WaAppAgent.exe installed.

B. VM1 has an unmanaged disk.
C. VM1 is stopped.
D. A Recovery Services vault is unavailable.
Answer: A
Explanation:
The Warning state indicates one or more issues in VM's configuration that might lead to backup
failures and provides recommended steps to ensure successful backups. Not having the latest
VM Agent installed, for example, can cause backups to fail intermittently and falls in this class of
issues.
References:
https://azure.microsoft.com/en-us/blog/azure-vm-backup-pre-checks/
QUESTION 150
You have two Azure virtual machines named VM1 and VM2.
You have two Recovery Services vaults named RSV1 and RSV2.
VM2 is protected by RSV1.
You need to use RSV2 to protect VM2.

A. From the RSV1 blade, click Backup items and stop the VM2 backup.
B. From the RSV1 blade, click Backup Jobs and export the VM2 backup.
C. From the RSV1 blade, click Backup. From the Backup blade, select the backup for the virtual
machine, and then click Backup.
D. From the VM2 blade, click Disaster recovery, click Replication settings, and then select RSV2 as
the Recovery Services vault.
Answer: A
Explanation:
https://docs.microsoft.com/en-us/azure/backup/backup-azure-vms-first-look-arm
QUESTION 151
You have an Azure virtual machine named VM1 that you use for testing.
VM1 is protected by Azure Backup.
You delete VM1.
You need to remove the backup data stored for VM1.
A. Modify the backup policy.

B. Delete the Recovery Services vault.
C. Stop the backup.
D. Delete the storage account.
Answer: C
Explanation:
Stop backup and delete recovery services vault, if no other backups.
https://docs.microsoft.com/en-us/azure/backup/tutorial-backup-vm-at-scale
QUESTION 152
exhibit.
(Click the Exhibit button.)
machines.
A. Integration Services
C. the memory
D. the hard drive
E. the processor
Answer: D
Explanation:
Before you upload a Windows virtual machines (VM) from on-premises to Microsoft Azure, you
must prepare the virtual hard disk (VHD or VHDX). Azure supports only generation 1 VMs that
are in the VHD file format and have a fixed sized disk. The maximum size allowed for the VHD is
1,023 GB. You can convert a generation 1 VM from the VHDX file system to VHD and from a
dynamically expanding disk to fixed-sized.
QUESTION 153
SIMULATION
Overview
possible by design.
doesn't matter how you accomplish the task, if you successfully perform it, you will earn credit for
that task.
To start the lab

You plan to back up all the Azure virtual machines in your Azure subscription at 02:00
Coordinated Universal Time (UTC) daily.
You need to prepare the Azure environment to ensure that any new virtual machines can be
configured quickly for backup. The solution must ensure that all the daily backups performed at
02:00 UTC are stored for only 90 days.
Answer: A
Explanation:
Task A: Create a Recovery Services vault (if a vault already exists skip this task, go to Task B
below)
A1. From Azure Portal, On the Hub menu, click All services and in the list of resources, type
Recovery Services and click Recovery Services vaults.
If there are recovery services vaults in the subscription, the vaults are listed.
A2. On the Recovery Services vaults menu, click Add.
A3. The Recovery Services vault blade opens, prompting you to provide a Name, Subscription,
Resource group, and Location
Task B.
B1. On the Recovery Services vault blade (for the vault you just created), in the Getting Started
section, click Backup, then on the Getting Started with Backup blade, select Backup goal.
The Backup Goal blade opens. If the Recovery Services vault has been previously configured,
then the Backup Goal blades opens when you click Backup on the Recovery Services vault
blade.
B2. From the Where is your workload running? drop-down menu, select Azure.
B3. From the What do you want to backup? menu, select Virtual Machine, and click OK.
B4. Finish the Wizard.
Task C. create a backup schedule

C1. Open the Microsoft Azure Backup agent. You can find it by searching your machine for
Microsoft Azure Backup.
C2. In the Backup agent's Actions pane, click Schedule Backup to launch the Schedule Backup
Wizard.
C3. On the Getting started page of the Schedule Backup Wizard, click Next.
C4. On the Select Items to Backup page, click Add Items.
The Select Items dialog opens.
C5. Select Blob Storage you want to protect, and then click OK.
C6.In the Select Items to Backup page, click Next.

On the Specify Backup Schedule page, specify
Schedule a backup every: day
At the following times: 2.00 AM
C7. On the Select Retention Policy page, set it to 90 days, and click Next.
C8. Finish the Wizard.
References:
QUESTION 154
SIMULATION
Overview
possible by design.
that task.
To start the lab

You recently created a virtual machine named Web01.
You need to attach a new 80-GB standard data disk named Web01-Disk1 to Web01.
Answer: A
Explanation:
Add a data disk
Step 1. In the Azure portal, from the menu on the left, select Virtual machines.
Step 2. Select the Web01 virtual machine from the list.
Step 3. On the Virtual machine page, , in Essentials, select Disks.
Step 4. On the Disks page, select the Web01-Disk1 from the list of existing disks.
Step 5. In the Disks pane, click + Add data disk.
Step 6. Click the drop-down menu for Name to view a list of existing managed disks accessible to
your Azure subscription. Select the managed disk Web01-Disk1 to attach:
References:
https://docs.microsoft.com/en-us/azure/virtual-machines/linux/attach-disk-portal
QUESTION 155
SIMULATION
Overview
possible by design.
that task.
To start the lab
You plan to allow connections between the VNET01-USEA2 and VNET01-USWE2 virtual
networks.
You need to ensure that virtual machines can communicate across both virtual networks by using
their private IP address. The solution must NOT require any virtual network gateways.
Answer: A
Explanation:
Virtual network peering enables you to seamlessly connect two Azure virtual networks. Once
peered, the virtual networks appear as one, for connectivity purposes.
Peer virtual networks

Step 1. In the Search box at the top of the Azure portal, begin typing VNET01-USEA2. When
VNET01- USEA2 appears in the search results, select it.
Step 2. Select Peerings, under SETTINGS, and then select + Add, as shown in the following
picture:
Step 3. Enter, or select, the following information, accept the defaults for the remaining settings,
and then select OK.
Name: myVirtualNetwork1-myVirtualNetwork2 (for example)
Subscription: elect your subscription.
Virtual network: VNET01-USWE2 - To select the VNET01-USWE2 virtual network, select Virtual
network, then select VNET01-USWE2. You can select a virtual network in the same region or in a
different region.
Now we need to repeat steps 1-3 for the other network VNET01-USWE2:
Step 4. In the Search box at the top of the Azure portal, begin typing VNET01- USEA2. When
VNET01- USEA2 appears in the search results, select it.
Step 5. Select Peerings, under SETTINGS, and then select + Add.
References:
https://docs.microsoft.com/en-us/azure/virtual-network/tutorial-connect-virtual-networks-portal
QUESTION 156
SIMULATION
Overview
possible by design.
that task.
To start the lab

You plan to host several secured websites on Web01.
You need to allow HTTPS over TCP port 443 to Web01 and to prevent HTTP over TCP port 80 to
Web01.
Answer: A
Explanation:
You can filter network traffic to and from Azure resources in an Azure virtual network with a
network security group. A network security group contains security rules that allow or deny
inbound network traffic to, or outbound network traffic from, several types of Azure resources.
A network security group contains security rules that allow or deny inbound network traffic to, or
outbound network traffic from, several types of Azure resources.
Step A: Create a network security group
A1. Search for and select the resource group for the VM, choose Add, then search for and select
Network security group.
A2. Select Create.
The Create network security group window opens.
A3. Create a network security group

Enter a name for your network security group.
Select or create a resource group, then select a location.
A4. Select Create to create the network security group.
Step B: Create an inbound security rule to allows HTTPS over TCP port 443
B1. Select your new network security group.
B2. Select Inbound security rules, then select Add.
B3. Add inbound rule
B4. Select Advanced.

From the drop-down menu, select HTTPS.
You can also verify by clicking Custom and selecting TCP port, and 443.
B5. Select Add to create the rule.
Repeat step B2-B5 to deny TCP port 80
B6. Select Inbound security rules, then select Add.
B7. Add inbound rule
B8. Select Advanced.

Clicking Custom and selecting TCP port, and 80.
B9. Select Deny.
Step C: Associate your network security group with a subnet

Your final step is to associate your network security group with a subnet or a specific network
interface.
C1. In the Search resources, services, and docs box at the top of the portal, begin typing Web01.
When the Web01 VM appears in the search results, select it.
C2. Under SETTINGS, select Networking. Select Configure the application security groups, select
the Security Group you created in Step A, and then select Save, as shown in the following
picture:
References:
https://docs.microsoft.com/en-us/azure/virtual-network/tutorial-filter-network-traffic
QUESTION 157
Hotspot Question
You have an Azure subscription that contains an Azure Storage account named storage1 and the
users shown in the following table.
You plan to monitor storage1 and to configure email notifications for the signals shown in the
following table.
You need to identify the minimum number of alert rules and action groups required for the
planned monitoring.
How many alert rules and action groups should you identify? To answer, select the appropriate
options in the answer area.
Answer:
QUESTION 158
Hotspot Question
You plan to deploy 20 Azure virtual machines by using an Azure Resource Manager template.
The virtual machines will run the latest version of Windows Server 2016 Datacenter by using an
Azure Marketplace image.
You need to complete the storageProfile section of the template.
How should you complete the storageProfile section? To answer, select the appropriate options
in the answer area.
Answer:
Explanation:
...
"storageProfile": {
"imageReference": {
"publisher": "MicrosoftWindowsServer",
"offer": "WindowsServer",
"sku": "2016-Datacenter",
"version": "latest"
},
...
References:
https://docs.microsoft.com/en-us/rest/api/compute/virtualmachines/createorupdate
QUESTION 159
Hotspot Question
You create a virtual machine scale set named Scale1. Scale1 is configured as shown in the
following exhibit.
Answer:
Explanation:
Box 1:
The Autoscale scale out rule increases the number of VMs by 2 if the CPU threshold is 80% or
higher. The initial instance count is 4 and rises to 6 when the 2 extra instances of VMs are added.
Box 2:
The Autoscale scale in rule decreases the number of VMs by 4 if the CPU threshold is 30% or
lower. The initial instance count is 4 and thus cannot be reduced to 0 as the minimum instances
is set to 2. Instances are only added when the CPU threshold reaches 80%.
References:
https://docs.microsoft.com/en-us/azure/azure-monitor/platform/autoscale-overview
https://docs.microsoft.com/en-us/azure/azure-monitor/platform/autoscale-best-practices
https://docs.microsoft.com/en-us/azure/azure-monitor/platform/autoscale-common-scale-patterns
QUESTION 160
Hotspot Question

You need to implement a custom policy that meet the following requirements:
* Ensures that each new resource group in the subscription has a tag
named organization set to a value of Contoso.
* Ensures that resource group can be created from the Azure portal.
* Ensures that compliance reports in the Azure portal are accurate.
How should you complete the policy? To answer, select the appropriate options in the answers
area.
Answer:
QUESTION 161
correct solution.
You have an Azure web app named App1. App1 runs in an Azure App Service plan named
Plan1. Plan1 is associated to the Free pricing tier.
You discover that App1 stops each day after running continuously for 60 minutes.
You need to ensure that App1 can run continuously for the entire day.
Solution: You change the pricing tier of Plan1 to Basic.
A. Yes
B. No
Answer: A
Explanation:
The Free Tier provides 60 CPU minutes / day. This explains why App1 is stops.
The Basic tier has no such cap.
References:
https://azure.microsoft.com/en-us/pricing/details/app-service/windows/
QUESTION 162
correct solution.
Solution: You add a triggered WebJob to App1.
A. Yes
B. No
Answer: B
Explanation:
You need to change to Basic pricing Tier.
Note: The Free Tier provides 60 CPU minutes / day. This explains why App1 is stops. The Basic
tier has no such cap.
References:
QUESTION 163
correct solution.
Solution: You change the pricing tier of Plan1 to Shared.
A. Yes
B. No
Answer: B
Explanation:
You should switch to the Basic Tier.
The Free Tier provides 60 CPU minutes / day. This explains why App1 is stops. The Shared Tier
provides 240 CPU minutes / day. The Basic tier has no such cap.
References:
QUESTION 164
correct solution.
You have an Azure Active Directory (Azure AD) tenant named Adatum and an Azure Subscription
named Subscription1. Adatum contains a group named Developers. Subscription1 contains a
resource group named Dev.
You need to provide the Developers group with the ability to create Azure logic apps in the Dev
resource group.
Solution: On Dev, you assign the Logic App Contributor role to the Developers group.
A. Yes
B. No
Answer: A
Explanation:
The Logic App Contributor role lets you manage logic app, but not access to them. It provides
access to view, edit, and update a logic app.
References:
https://docs.microsoft.com/en-us/azure/logic-apps/logic-apps-securing-a-logic-app
QUESTION 165
correct solution.
resource group.
Solution: On Subscription1, you assign the Logic App Operator role to the Developers group.
A. Yes
B. No
Answer: B
Explanation:
The Logic App Operator role only lets you read, enable and disable logic app. With it you can
view the logic app and run history, and enable/disable. Cannot edit or update the definition.
You would need the Logic App Contributor role.
References:
QUESTION 166
correct solution.
resource group.
Solution: On Subscription1, you assign the DevTest Labs User role to the Developers group.
A. Yes
B. No
Answer: B
Explanation:
DevTest Labs User role only lets you connect, start, restart, and shutdown virtual machines in
your Azure DevTest Labs.
References:
QUESTION 167
correct solution.
You manage a virtual network named VNet1 that is hosted in the West US Azure region.
VNet1 hosts two virtual machines named VM1 and VM2 that run Windows Server.
You need to inspect all the network traffic from VM1 to VM2 for a period of three hours.
Solution: From Performance Monitor, you create a Data Collector Set (DCS).
A. Yes
B. No
Answer: B
Explanation:
You should use Azure Network Watcher.
References:
QUESTION 168
correct solution.
You manage a virtual network named VNet1 that is hosted in the West US Azure region. VNet1
hosts two virtual machines named VM1 and VM2 that run Windows Server.
Solution: From Azure Network Watcher, you create a packet capture.
A. Yes
B. No
Answer: A
Explanation:
Packet Capture can inspect 18000 seconds (5 hours) Network Status.
QUESTION 169
correct solution.
Solution: From Azure Monitor, you create a metric on Network In and Network Out.
A. Yes
B. No
Answer: B
Explanation:
You should use Azure Network Watcher.
References:
QUESTION 170
A web developer creates a web application that you plan to deploy as an Azure web app.
Users must enter credentials to access the web application.
You create a new web app named WebApp1 and deploy the web application to WebApp1.
You need to disable anonymous access to WebApp1.
A. Advanced Tools
B. Authentication/Authorization
C. Access control (IAM)
D. Deployment credentials
Answer: B
Explanation:
Anonymous access is an authentication method. It allows users to establish an anonymous
connection.
References:
https://docs.microsoft.com/en-us/biztalk/core/guidelines-for-resolving-iis-permissions-problems
QUESTION 171
You are building a custom Azure function app to connect to Azure Event Grid.
You need to ensure that resources are allocated dynamically to the function app. Billing must be
based on the executions of the app.
What should you configure when you create the function app?
A. the Windows operating system and the Consumption plan hosting plan
B. the Windows operating system and the App Service plan hosting plan
C. the Docker container and an App Service plan that uses the B1 pricing tier
D. the Docker container and an App Service plan that uses the S1 pricing tier
Answer: A
Explanation:
Azure Functions runs in two different modes: Consumption plan and Azure App Service plan. The
Consumption plan automatically allocates compute power when your code is running. Your app is
scaled out when needed to handle load, and scaled down when code is not running.
Incorrect Answers:
B: When you run in an App Service plan, you must manage the scaling of your function app.
References:
https://docs.microsoft.com/en-us/azure/azure-functions/functions-create-first-azure-function
QUESTION 172
You have an Azure App Service plan named AdatumASP1 that uses the P2v2 pricing tier.
AdatunASP1 hosts an Azure web app named adatumwebapp1.
You need to delegate the management of adatumwebapp1 to a group named Devs.

Devs must be able to perform the following tasks:
- Add deployment slots.

- View the configuration of AdatunASP1.
- Modify the role assignment for adatumwebapp1.
Which role should you assign to the Devs group?
A. Owner
B. Contributor
C. Web Plan Contributor
D. Website Contributor
Answer: A
Explanation:
QUESTION 173
You have an Azure App Service plan that hosts an Azure App Service named App1.
You configure one production slot and four staging slots for App1.
You need to allocate 10 percent of the traffic to each staging slot and 60 percent of the traffic to
the production slot.
What should you add to App1?
A. slots to the Testing in production blade

B. a performance test
C. a WebJob
D. templates to the Automation script blade
Answer: A
Explanation:
Besides swapping, deployment slots offer another killer feature: testing in production. Just like the
name suggests, using this, you can actually test in production. This means that you can route a
specific percentage of user traffic to one or more of your deployment slots.
Example:
References:
https://stackify.com/azure-deployment-slots/
QUESTION 174
You have an Azure Service Bus.
You need to implement a Service Bus queue that guarantees first-in-first-out (FIFO) delivery of
messages.
What should you do?
A. Set the Lock Duration setting to 10 seconds.
B. Enable duplicate detection.
C. Set the Max Size setting of the queue to 5 GB.
D. Enable partitioning.
E. Enable sessions.
Answer: E
Explanation:
Through the use of messaging sessions you can guarantee ordering of messages, that is first-in-
first-out (FIFO) delivery of messages.
References:
https://docs.microsoft.com/en-us/azure/service-bus-messaging/service-bus-azure-and-service-
bus-queues-compared-contrasted
QUESTION 175
You have a Microsoft SQL Server Always On availability group on Azure virtual machines.
You need to configure an Azure internal load balancer as a listener for the availability group.
What should you do?
A. Enable Floating IP.

B. Set Session persistence to Client IP and protocol.
C. Set Session persistence to Client IP.
D. Create an HTTP health probe on port 1433.
Answer: A
Explanation:
Incorrect Answers:
D: The Health probe is created with the TCP protocol, not with the HTTP protocol.
References:
https://docs.microsoft.com/en-us/azure/virtual-machines/windows/sql/virtual-machines-windows-
portal-sql-alwayson-int-listener
QUESTION 176
Hotspot Question
Your network contains an Active Directory domain named adatum.com and an Azure Active
Directory (Azure AD) tenant named adatum.onmicrosoft.com.
Adatum.com contains the user accounts in the following table.
Adatum.onmicrosoft.com contains the user accounts in the following table.
You need to implement Azure AD Connect. The solution must follow the principle of least
privilege.
Which user accounts should you use? To answer, select the appropriate options in the answer
area.
Answer:
Explanation:
Box 1: User5
In Express settings, the installation wizard asks for the following:
AD DS Enterprise Administrator credentials
Azure AD Global Administrator credentials
The AD DS Enterprise Admin account is used to configure your on-premises Active Directory.
These credentials are only used during the installation and are not used after the installation has
completed. The Enterprise Admin, not the Domain Admin should make sure the permissions in
Active Directory can be set in all domains.
Box 2: UserA
Azure AD Global Admin credentials credentials are only used during the installation and are not
used after the installation has completed. It is used to create the Azure AD Connector account
used for synchronizing changes to Azure AD. The account also enables sync as a feature in
Azure AD.
aadconnect-accounts-permissions
QUESTION 177
You have an Azure subscription named Subscription1 that is used be several departments at
your company. Subscription1 contains the resources in the following table:
Another administrator deploys a virtual machine named VM1 and an Azure Storage account
named Storage2 by using a single Azure Resource Manager template. You need to view the
template used for the deployment. From which blade can you view the template that was used for
the deployment?
A. RG1
B. VM1
C. Storage1
D. Container1
Answer: A
Explanation:
1. View template from deployment history
Go to the resource group for your new resource group. Notice that the portal shows the result of
the last deployment. Select this link.
The portal displays a summary of the deployment. The summary includes the status of the
References: https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-manager-
export-template
QUESTION 178
You have an Azure subscription named Subscription1. Subscription1 contains the resource
groups in the following table.
RG1 has a web app named WebApp1. WebApp1 is located in West Europe. You move WebApp1
to RG2. What is the effect of the move?
A. The App Service plan to WebApp1 moves to North Europe. Policy2 applies to WebApp1.
B. The App Service plan to WebApp1 moves to North Europe. Policy1 applies to WebApp1.
C. The App Service plan to WebApp1 remains to West Europe. Policy2 applies to WebApp1.
D. The App Service plan to WebApp1 remains to West Europe. Policy1 applies to WebApp1.
Answer: C
Explanation:
You can move an app to another App Service plan, as long as the source plan and the target plan
are in the same resource group and geographical region.
The region in which your app runs is the region of the App Service plan it's in. However, you
cannot change an App Service plan's region.
References:
https://docs.microsoft.com/en-us/azure/app-service/app-service-plan-manage
QUESTION 179
You have a resource group named RG1. RG1 contains an Azure Storage account named
storageaccount1 and a virtual machine named VM1 that runs Windows Server 2016.
Storageaccount1 contains the disk files for VM1. You apply a ReadOnly lock to RG1.
What can you do from the Azure portal?
A. Generate an automation script for RG1.
B. View the keys of storageaccount1.
C. Upload a blob to storageaccount1.
D. Start VM1.
Answer: A
Explanation:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources
Applying ReadOnly can lead to unexpected results because some operations that don't seem to
modify the resource actually require actions that are blocked by the lock. The ReadOnly lock can
be applied to the resource or to the resource group containing the resource. Some common
examples of the operations that are blocked by a ReadOnly lock are:
A ReadOnly lock on a storage account prevents all users from listing the keys. The list keys
operation is handled through a POST request because the returned keys are available for write
operations.
QUESTION 180
You configure Azure AD Connect for Azure Active Directory Seamless Single Sign-On (Azure AD
Seamless SSO) for an on-premises network. Users report that when they attempt to access
myapps.microsoft.com, they are prompted multiple times to sign in and are forced to use an
account name that ends with onmicrosoft.com.
You discover that there is a UPN mismatch between Azure AD and the on-premises Active
Directory. You need to ensure that the users can use single-sign on (SSO) to access Azure
resources.
A. From the on-premises network, deploy Active Directory Federation Services (AD FS).
B. From Azure AD, add and verify a custom domain name.
C. From the on-premises network, request a new certificate that contains the Active Directory
domain name.
D. From the server that runs Azure AD Connect, modify the filtering options.
Answer: B
Explanation:
Azure AD Connect lists the UPN suffixes that are defined for the domains and tries to match them
with a
custom domain in Azure AD. Then it helps you with the appropriate action that needs to be taken.
The Azure AD sign-in page lists the UPN suffixes that are defined for on-premises Active
Directory and displays the corresponding status against each suffix. The status values can be
one of the following:
State: Verified Azure AD Connect found a matching verified domain in Azure AD. All users for this
domain can sign in by using their on-premises credentials. State: Not verified Azure AD Connect
found a matching custom domain in Azure AD, but it isn't verified. The UPN suffix of the users of
this domain will be changed to the default .onmicrosoft.com suffix after synchronization if the
domain isn't verified. Action Required: Verify the custom domain in Azure AD.
References: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/plan-connect-user-
signin
QUESTION 181
You have two Azure Active Directory (Azure AD) tenants named contoso.com and fabrikam.com.
You have a Microsoft account that you use to sign in to both tenants.
You need to configure the default sign-in tenant for the Azure portal.
What should you do?
A. From the Azure portal, configure the portal settings.
B. From the Azure portal, change the directory.
C. From Azure Cloud Shell, run Set-AzureRmContext.
D. From Azure Cloud Shell, run Set-AzureRmSubscription.
Answer: B
Explanation:
Change the subscription directory in the Azure portal. The classic portal feature Edit Directory,
that allows you to associate an existing subscription to your Azure Active Directory (AAD), is now
available in Azure portal. It used to be available only to Service Admins with Microsoft accounts,
but now it's available to users with AAD accounts as well.
To get started:
Go to Subscriptions.
Select a subscription.
Select Change directory.
Incorrect Answers:
C: The Set-AzureRmContext cmdlet sets authentication information for cmdlets that you run in
the current session. The context includes tenant, subscription, and environment information.
References: https://azure.microsoft.com/en-us/updates/edit-directory-now-in-new-portal/
QUESTION 182
You sign up for Azure Active Directory (Azure AD) Premium.
You need to add a user named admin1@contoso.com as an administrator on all the computers
that will be joined to the Azure AD domain.
What should you configure in Azure AD?
A. Device settings from the Devices blade.

B. General settings from the Groups blade.
C. User settings from the Users blade.
D. Providers from the MFA Server blade.
Answer: A
Explanation:
When you connect a Windows device with Azure AD using an Azure AD join, Azure AD adds the
following security principles to the local administrators group on the device:
The Azure AD global administrator role
The Azure AD device administrator role
The user performing the Azure AD join
In the Azure portal, you can manage the device administrator role on the Devices page. To open
the Devices page:
1. Sign in to your Azure portal as a global administrator or device administrator.
2. On the left navbar, click Azure Active Directory.
3. In the Manage section, click Devices.
4. On the Devices page, click Device settings.
5. To modify the device administrator role, configure Additional local administrators on Azure AD
joined devices.
References:
https://docs.microsoft.com/en-us/azure/active-directory/devices/assign-local-admin
QUESTION 183
correct solution.
After you answer a question in this section, you will NOT be able to return to it As a result

for a host named www that has an IP address of 131.107.1.10. You discover that Internet hosts
are unable to resolve www.contoso.com to the 131.107.1.10 IP address.
Solution: You create a PTR record for www in the contoso.com zone.
A. Yes
B. No
Answer: B
Explanation:
Modify the Name Server (NS) record.
References: https://docs.microsoft.com/en-us/azure/dns/dns-delegate-domain-azure-dns
QUESTION 184
correct solution.
After you answer a question in this section, you will NOT be able to return to it As a result
A. Yes
B. No
Answer: B
QUESTION 185
You have an Azure DNS zone named adatum.com.
You need to delegate a subdomain named research.adatum.com to a different DNS server in
Azure.
What should you do?
A. Create an PTR record named research in the adatum.com zone.
B. Create an NS record named research in the adatum.com zone.
C. Modify the SOA record of adatum.com.
D. Create an A record named ".research in the adatum.com zone.
Answer: B
Explanation:
You need to create a name server (NS) record for the zone.
References:
https://docs.microsoft.com/en-us/azure/dns/delegate-subdomain
QUESTION 186
Note: This question is part of a series questions that present the same scenario. Each
correct solution.
You manage a virtual network named Vnet1 that is hosted in the West US Azure region. VNet
hosts two virtual machines named VM1 and VM2 run Windows Server.
Solution: From Azure Network Watcher, you create a connection monitor.
A. YES
B. NO
Answer: B
Explanation:
Connection Monitor only gives a 'red/green' status for a given connection, whereas the question
states you need to see all traffic.
https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-packet-capture-
overview
QUESTION 187
You have a virtual network named VNet1 as shown in the exhibit.
No devices are connected to VNet1.
You plan to peer VNet1 to another virtual network named Vnet2 in the same region. VNet2 has
an address space of 10.2.0.0/16.
You need to create the peering.
A. Modify the address space of VNet1.

B. Configure a service endpoint on VNet2
C. Add a gateway subnet to VNet1.
D. Create a subnet on VNet1 and VNet2.
Answer: A
Explanation:
The virtual networks you peer must have non-overlapping IP address spaces.
References:
QUESTION 188
You have an Azure subscription that contains three virtual networks named VNet1, VNet2, VNet3.
VNet2 contains a virtual appliance named VM2 that operates as a router. You are configuring the
virtual networks in a hub and spoke topology that uses VNet2 as the hub network.
You plan to configure peering between VNet1 and VNet2 and between VNet2 and VNet3.
You need to provide connectivity between VNet1 and VNet3 through VNet2.
Which two configurations should you perform? Each correct answer presents part of the solution.
A. On the peering connections, allow forwarded traffic.

B. On the peering connections, allow gateway transit.
C. Create route tables and assign the table to subnets.
D. Create a route filter.
E. On the peering connections, use remote gateways.
Answer: AC
Explanation:
You need to provide connectivity between VNet1 and VNet3 through VNet2." It's not about
remote gateways or connectivity outside the Vnets. So A (to forward traffic from a spoke vnet to
another spoke) and C (without UDR and NVA as next hop IP traffic won't flow between the
spokes).
QUESTION 189
correct solution.
Solution: You add a continuous WebJob to App1.
A. Yes
B. No
Answer: B
QUESTION 190
correct solution.
resource group.
Solution: On Dev, you assign the Contributor role to the Developers group.
A. Yes
B. No
Answer: A
Explanation:
The Contributor role can manage all resources (and add resources) in a Resource Group.
QUESTION 191
You have an Azure Logic App named App1. App1 provides a response when an HTTP POST
request or an HTTP GET request is received.
During peak periods, App1 is expected to receive up to 200,000 requests in a five-minute period.
You need to ensure that App1 can handle the expected load.
A. Access control (IAM)

B. API connections
C. Workflow settings
D. Access keys
Answer: C
Explanation:
https://docs.microsoft.com/en-us/azure/logic-apps/logic-apps-limits-and-config#throughput-limits
QUESTION 192
You have a Basic App Service plan named ASP1 that hosts an Azure App Service named App1.
You need to configure a custom domain and enable backups for App1.
A. Configure a WebJob for App1.

B. Scale up ASP1.
C. Scale out ASP1.
D. Configure the application settings for App1.
Answer: D
QUESTION 193
You have an Azure App Service plan named AdatumASP1 that hosts several Azure web apps.
You discover that the web apps respond slowly.
You need to provide additional memory and CPU resources to each instance of the web app.
What should you do?
A. Scale out AdatumASP1.

B. Add continuous WebJobs that use the multi-instance scale.
C. Scale up AdatumASP1.
D. Add a virtual machine scale set.
Answer: C
Explanation:
https://github.com/MicrosoftDocs/azure-docs/blob/master/articles/app-service/web-sites-scale.md
QUESTION 194
You have an Azure web app named App1 that streams video content to users. App1 is located in
the East US Azure region.
Users in North America stream the video content without any interruption.
Users in Asia and Europe report that the video buffer often and do not play back smoothly.
You need to recommend a solution to improve video streaming to the European and Asian users.
What should you recommend?
A. Scale out the App Service plan.

B. Scale up the App Service plan.
C. Configure an Azure Content Delivery Network (CDN) endpoint.
D. Configure Azure File Sync.
Answer: C
QUESTION 195
A. Yes
B. No
Answer: B
Explanation:
https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-packet-capture-
manage-portal
QUESTION 196
Users access the resources in the subscription from either home or from customer sites. From
home, users must establish a point-to-site VPN to access the Azure resources. The users on the
customer sites access the Azure resources by using site-to-site VPNs.
You have a line-of-business app named App1 that runs on several Azure virtual machine.
The virtual machines run Windows Server 2016.
You need to ensure that the connections to App1 are spread across all the virtual machines.
What are two possible Azure services that you can use? Each correct answer presents a
complete solution.
A. a public load balancer

B. Traffic Manager
C. an Azure Content Delivery Network (CDN)
D. an internal load balancer
E. an Azure Application Gateway
Answer: DE
QUESTION 197
You have an Azure subscription named Subscription1 that contains an Azure virtual network
named VNet1. VNet1 connects to your on-premises network by using Azure ExpressRoute.
You need to connect VNet1 to the on-premises network by using a site-to-site VPN. The solution
must minimize cost.
A. Create a local site VPN gateway.

B. Create a VPN gateway that uses the VpnGw1 SKU.
C. Create a VPN gateway that uses the Basic SKU.
D. Create a gateway subnet.
E. Create a connection.
Answer: ABE
Explanation:
For a site to site VPN, you need a local gateway, a gateway subnet, a VPN gateway, and a
connection to connect the local gateway and the VPN gateway. That would be four answers in
this question. However, the question states that VNet1 connects to your on-premises network by
using Azure ExpressRoute. For an ExpressRoute connection, VNET1 must already be configured
with a gateway subnet so we don't need another one.
QUESTION 198
You have an Azure subscription named Subscription1 that contains two Azure virtual networks
named VNet1 and VNet2. VNet1 contains a VPN gateway named VPNGW1 that uses static
routing. There is a site-to-site VPN connection between your on-premises network and VNet1.
On a computer named Client1 that runs Windows10, you configure a point-to-site VPN
connection to VNet1.
You configure virtual network peering between VNet1 and VNet2. You verify that you can connect
to VNet2 from the on-premises network. Client1 is unable to connect to VNet2.
You need to ensure that you can connect Client1 to VNet2.
What should you do?
A. Select Allow gateway transit on VNet2.

B. Enable BGP on VPNGW1.
C. Select Allow gateway transit on VNet1.
D. Download and re-install the VPN client configuration package on Client1.
Answer: D
Explanation:
https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-point-to-site-routing
QUESTION 199
You are troubleshooting a performance issue for an Azure Application Gateway.
You need to compare the total requests to the failed requests during the past six hours.
A. Connection monitor in Azure Network Watcher.

B. Metrics in Application Gateway
C. Diagnostics logs in Application Gateway
D. NSG flow logs in Azure Network Watcher
Answer: B
Explanation:
https://docs.microsoft.com/en-us/azure/application-gateway/application-gateway-
diagnostics#metrics
QUESTION 200
A. IP flow verify
B. Connection monitor
C. Connection troubleshoot
D. NSG flow logs
Answer: B
QUESTION 201
You deploy an Azure Application Gateway.
You need to ensure that all the traffic requesting https://adatum.com/internal resources is directed
to an internal server pool and all the traffic requesting https://adatum.com/external resources is
directed to an external server pool.
What should you configure on the Application Gateway?
A. URL path-based routing

B. multi-site listeners
C. basic routing
D. SSL termination
Answer: A
QUESTION 202
Hotspot Question
You have an Azure subscription that contains the resource groups shown in the following table.
RG1 contains the resources shown in the following table.
VM1 is running and connects to NIC1 and Disk1. NIC1 connects to VNET1.
RG2 contains a public IP address named IP2 that is in the East US location. IP2 is not assigned
to a virtual machine.
Answer:
Explanation:
Box 1: Yes
You can move storage
Box 2: No
You can't move to a new resource group a NIC that is attached to a virtual machine.
Box 3: No
Azure Public IPs are region specific and can't be moved from one region to another.
Reference:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/move-support-
resources
https://docs.microsoft.com/en-us/azure/virtual-network/move-across-regions-publicip-powershell
QUESTION 203
You have an Azure Active Directory (Azure AD) tenant that has Azure AD Privileged Identity
Management configured.
You have 10 users who are assigned the Security Administrator role for the tenant.
You need the users to verify whether they still require the Security Administrator role.
What should you do?
A. From Azure AD Identity Protection, configure a user risk policy.

B. From Azure AD Privileged Identity Management, create an access review.
C. From Azure AD Identity Protection, configure the Weekly Digest.
D. From Azure AD Privileged Identity Management, create a conditional access policy.
Answer: B
Explanation:
https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-how-
to-start-security-review
QUESTION 204
adatum.com.
What should you do?
A. Create an Azure AD conditional access policy.

B. Enable Azure AD Privileged Identity Management.
C. Install and configure Azure AD Connect.
D. Configure a playbook in Azure Security Center.
Answer: A
Explanation:
https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-getstarted
QUESTION 205
Case Study 1 - Humongous Insurance
Overview
Humongous Insurance is an insurance company that has three offices in Miami, Tokyo and
Bangkok. Each office has 5.000 users.
Existing Environment
Active Directory Environment
Humongous Insurance has a single-domain Active Directory forest named
humongousinsurance.com. The functional level of the forest is Windows Server 2012.
You recently provisioned an Azure Active Directory (Azure AD) tenant.
Network Infrastructure
Each office has a local data center that contains all the servers for that office. Each office has a
dedicated connection to the Internet.
Each office has several link load balancers that provide access to the servers.
Active Directory Issue

Several users in humongousinsurance.com have UPNs that contain special characters.
You suspect that some of the characters are unsupported in Azure AD.
Licensing Issue
You attempt to assign a license in Azure to several users and receive the following error
message: "Licenses not assigned. License agreement failed for one user."
You verify that the Azure subscription has the available licenses.
Requirements
Planned Changes
Humongous Insurance plans to open a new office in Paris. The Paris office will contain 1,000
users who will be hired during the next 12 months. All the resources used by the Paris office
users will be hosted in Azure.
Planned Azure AD Infrastructure

The on-premises Active Directory domain will be synchronized to Azure AD.
All client computers in the Paris office will be joined to an Azure AD domain.
Planned Azure Networking Infrastructure

You plan to create the following networking resources in a resource group named All_Resources:
- Default Azure system routes that will be the only routes used to
route traffic
- A virtual network named Paris-VNet that will contain two subnets
named Subnet1 and Subnet2
- A virtual network named ClientResources-VNet that will contain one
subnet named ClientSubnet
- A virtual network named AllOffices-VNet that will contain two subnets
You plan to enable peering between Paris-VNet and AllOffices-VNet. You will enable the Use
remote gateways setting for the Paris-VNet peerings.
You plan to create a private DNS zone named humongousinsurance.local and set the registration
network to the ClientResources-VNet virtual network.
Planned Azure Computer Infrastructure

Each subnet will contain several virtual machines that will run either Windows Server 2012 R2,
Windows Server 2016, or Red Hat Linux.
Department Requirements
Humongous Insurance identifies the following requirements for the company's departments:
- Web administrators will deploy Azure web apps for the marketing
department. Each web app will be added to a separate resource group.
The initial configuration of the web apps will be identical. The web
administrators have permission to deploy web apps to resource groups.
- During the testing phase, auditors in the finance department must be
able to review all Azure costs from the past week.
Authentication Requirements
Users in the Miami office must use Azure Active Directory Seamless Single Sign-on (Azure AD
Seamless SSO) when accessing resources in Azure.
You need to resolve the licensing issue before you attempt to assign the license again.
What should you do?
A. From the Groups blade, invite the user accounts to a new group.
B. From the Profile blade, modify the usage location.
C. From the Directory role blade, modify the directory role.
Answer: B
Explanation:
License cannot be assigned to a user without a usage location specified.
Scenario: Licensing Issue
message:
"Licenses not assigned. License agreement failed for one user."
QUESTION 206
Overview

Licensing Issue
Requirements
Planned Changes

route traffic

Which blade should you instruct the finance department auditors to use?
A. Partner information
B. Overview
C. Payment methods
D. Invoices
Answer: D
Explanation:
You can opt in and configure additional recipients to receive your Azure invoice in an email. This
feature may not be available for certain subscriptions such as support offers, Enterprise
Agreements, or Azure in Open.
Select your subscription from the Subscriptions page. Opt-in for each subscription you own. Click
Invoices then Email my invoice.
Click Opt in and accept the terms.
Scenario: During the testing phase, auditors in the finance department must be able to review all
Azure costs from the past week.
References: https://docs.microsoft.com/en-us/azure/billing/billing-download-azure-invoice-daily-
usage-date
QUESTION 207
Overview

Licensing Issue
Requirements
Planned Changes


route traffic

Hotspot Question
You are evaluating the name resolution for the virtual machines after the planned implementation
of the Azure networking infrastructure.
Answer:
Explanation:
Box 1: Yes
All client computers in the Paris office will be joined to an Azure AD domain. A virtual network
named Paris-VNet that will contain two subnets named Subnet1 and Subnet2
Box 2: Yes
A virtual network named ClientResources-VNet that will contain one subnet named ClientSubnet
Box 3: No
Only VMs in the registration network, here the ClientResources-VNet, will be able to register
hostname records.
References:
https://docs.microsoft.com/en-us/azure/dns/private-dns-overview Testlet 3
QUESTION 208
Overview

Licensing Issue
Requirements
Planned Changes


route traffic

You need to prepare the environment to meet the authentication requirements.

NOTE Each correct selection is worth one point.
A. Join the client computers in the Miami office to Azure AD.

B. Add http://autologon.microsoftazuread-sso.com to the intranet zone of each client computer in the
Miami office.
C. Allow inbound TCP port 8080 to the domain controllers in the Miami office.
D. Install Azure AD Connect on a server in the Miami office and enable Pass-through Authentication
E. Install the Active Directory Federation Services (AD FS) role on a domain controller in the Miami
office.
Answer: BD
Explanation:
D: Seamless SSO works with any method of cloud authentication - Password Hash
Synchronization or Pass-through Authentication, and can be enabled via Azure AD Connect.
B: You can gradually roll out Seamless SSO to your users. You start by adding the following
Azure AD URL to all or selected users' Intranet zone settings by using Group Policy in Active
Directory: https://autologon.microsoftazuread-sso.com
Incorrect Answers:
A: Seamless SSO needs the user's device to be domain-joined, but doesn't need for the device to
be Azure AD Joined.
C: Azure AD connect does not port 8080. It uses port 443.
E: Seamless SSO is not applicable to Active Directory Federation Services (ADFS).
Scenario: Users in the Miami office must use Azure Active Directory Seamless Single Sign-on
(Azure AD Seamless SSO) when accessing resources in Azure.
Planned Azure AD Infrastructure include: The on-premises Active Directory domain will be
synchronized to Azure AD.
aadconnect-sso-quick-start
QUESTION 209
Overview

Licensing Issue
Requirements
Planned Changes


route traffic

You need to resolve the Active Directory issue.

What should you do?
A. From Active Directory Users and Computers, select the user accounts, and then modify the User
Principal Name value.
B. Run the IdFix tool then use the Update actions.
C. From Active Directory Domains and Trusts, modify the list of UPN suffixes.
D. From Azure AD Connect, modify the outbound synchronization rule.
Answer: B
Explanation:
IdFix is used to perform discovery and remediation of identity objects and their attributes in an on-
premises Active Directory environment in preparation for migration to Azure Active Directory.
IdFix is intended for the Active Directory administrators responsible for directory synchronization
with Azure Active Directory.
Scenario: Active Directory Issue
Several users in humongousinsurance.com have UPNs that contain special characters. You
suspect that some of the characters are unsupported in Azure AD.
References: https://www.microsoft.com/en-us/download/details.aspx?id=36832
QUESTION 210
Overview

Licensing Issue
Requirements
Planned Changes


route traffic

Which blade should you instruct the finance department auditors to use?
A. invoices
B. partner information
C. cost analysis
D. External services
Answer: A
QUESTION 211
Overview

Licensing Issue
Requirements
Planned Changes


route traffic

You need to define a custom domain name for Azure AD to support the planned infrastructure.
Which domain name should you use?
A. ad.humongousinsurance.com
B. humongousinsurance.onmicrosoft.com
C. humongousinsurance.local
D. humongousinsurance.com
Answer: D
Explanation:
Every Azure AD directory comes with an initial domain name in the form of
domainname.onmicrosoft.com. The initial domain name cannot be changed or deleted, but you
can add your corporate domain name to Azure AD as well. For example, your organization
probably has other domain names used to do business and users who sign in using your
corporate domain name. Adding custom domain names to Azure AD allows you to assign user
names in the directory that are familiar to your users, such as ‘alice@contoso.com.’ instead of
'alice@domain name.onmicrosoft.com'.
Scenario:
Network Infrastructure: Each office has a local data center that contains all the servers for that
office. Each office has a dedicated connection to the Internet.
humongousinsurance.com
Planned Azure AD Infrastructure: The on-premises Active Directory domain will be synchronized
to Azure AD.
References: https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/add-custom-
domain
QUESTION 212
Overview

Licensing Issue
Requirements
Planned Changes


route traffic

You need to prepare the environment to ensure that the web administrators can deploy the web
apps as quickly as possible.
Answer:
QUESTION 213
Case Study 2 - Contoso, Ltd
Overview
Contoso, Ltd. is a manufacturing company that has offices worldwide. Contoso works with partner
organizations to bring products to market.
Contoso products are manufactured by using blueprint files that the company authors and
maintains.
Currently, Contoso uses multiple types of servers for business operations, including the following:
- File servers
- Domain controllers
- Microsoft SQL Server servers
Your network contains an Active Directory forest named contoso.com. All servers and client
computers are joined to Active Directory.
You have a public-facing application named App1. App1 is comprised of the following three tiers:
- A SQL database
- A web front end
- A processing middle tier
Each tier is comprised of five virtual machines. Users access the web front end by using HTTPS
only.
Requirements
Planned Changes
Contoso plans to implement the following changes to the infrastructure:
- Move all the tiers of App1 to Azure.
- Move the existing product blueprint files to Azure Blob storage.
- Create a hybrid directory to support an upcoming Microsoft Office 365
migration project.
Technical Requirements
Contoso must meet the following technical requirements:
- Move all the virtual machines for App1 to Azure.
- Minimize the number of open ports between the App1 tiers.
- Ensure that all the virtual machines for App1 are protected by
backups.
- Copy the blueprint files to Azure over the Internet.
- Ensure that the blueprint files are stored in the archive storage
tier.
- Ensure that partner access to the blueprint files is secured and
temporary.
- Prevent user passwords or hashes of passwords from being stored in
Azure.
- Use unmanaged standard storage for the hard disks of the
virtualmachines.
- Ensure that when users join devices to Azure Active Directory (Azure
AD), the users use a mobile phone to verify their identity.
- Minimize administrative effort whenever possible.
User Requirements
Contoso identifies the following requirements for users:
- Ensure that only users who are part of a group named Pilot can join
devices to Azure AD.
- Designate a new user named Admin1 as the service administrator of the
Azure subscription.
- Ensure that a new user named User3 can create network objects for the
Azure subscription.
You need to meet the user requirement for Admin1.

What should you do?
A. From the Subscriptions blade, select the subscription, and then modify the Properties.
B. From the Subscriptions blade, select the subscription, and then modify the Access control (IAM)
settings.
C. From the Azure Active Directory blade, modify the Properties.
D. From the Azure Active Directory blade, modify the Groups.
Answer: A
Explanation:
Change the Service administrator for an Azure subscription Sign in to Account Center as the
Account administrator.
Select a subscription.
On the right side, select Edit subscription details.
Scenario: Designate a new user named Admin1 as the service administrator of the Azure
subscription.
References: https://docs.microsoft.com/en-us/azure/billing/billing-add-change-azure-subscription-
administrator
QUESTION 214
Overview
maintains.
- File servers
- A SQL database
- A web front end
only.
Requirements
Planned Changes
migration project.
backups.
tier.
temporary.
Azure.
virtualmachines.
User Requirements
Azure subscription.
Azure subscription.
You need to move the blueprint files to Azure.

What should you do?
A. Generate a shared access signature (SAS). Map a drive, and then copy the files by using File
Explorer.
B. Use the Azure Import/Export service.
C. Generate an access key. Map a drive, and then copy the files by using File Explorer.
D. Use Azure Storage Explorer to copy the files.
Answer: D
Explanation:
Azure Storage Explorer is a free tool from Microsoft that allows you to work with Azure Storage
data on Windows, macOS, and Linux. You can use it to upload and download data from Azure
blob storage.
Scenario:
Planned Changes include: move the existing product blueprint files to Azure Blob storage.
Technical Requirements include: Copy the blueprint files to Azure over the Internet. References:
https://docs.microsoft.com/en-us/azure/machine-learning/team-data-science-process/move-data-
to-azure-blob-using-azure-storage-explorer
QUESTION 215
Overview
maintains.
- File servers
- A SQL database
- A web front end
only.
Requirements
Planned Changes
migration project.
backups.
tier.
temporary.
Azure.
virtualmachines.
User Requirements
Azure subscription.
Azure subscription.
You need to implement a backup solution for App1 after the application is moved.
What should you create first?
A. a recovery plan
B. an Azure Backup Server
C. a backup policy
D. a Recovery Services vault
Answer: D
Explanation:
A Recovery Services vault is a logical container that stores the backup data for each protected
resource, such as Azure VMs. When the backup job for a protected resource runs, it creates a
recovery point inside the Recovery Services vault.
Scenario:
There are three application tiers, each with five virtual machines.
Move all the virtual machines for App1 to Azure.
Ensure that all the virtual machines for App1 are protected by backups. References:
https://docs.microsoft.com/en-us/azure/backup/quick-backup-vm-portal
QUESTION 216
Overview
maintains.
- File servers
- A SQL database
- A web front end
only.
Requirements
Planned Changes
migration project.
backups.
tier.
temporary.
Azure.
virtualmachines.
User Requirements
Azure subscription.
Azure subscription.
Hotspot Question
You need to recommend a solution for App1. The solution must meet the technical requirements.
What should you include in the recommendation? To answer, select the appropriate options in
the answer area.
Answer:
Explanation:
This reference architecture shows how to deploy VMs and a virtual network configured for an N-
tier application, using SQL Server on Windows for the data tier.
Scenario: You have a public-facing application named App1. App1 is comprised of the following
three tiers:
A SQL database
A web front end
A processing middle tier
only.
Technical requirements include:
Minimize the number of open ports between the App1 tiers. References:
https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/n-tier/n-tier-sql-server
QUESTION 217
Overview
maintains.
- File servers
- A SQL database
- A web front end
only.
Requirements
Planned Changes
migration project.
backups.
tier.
temporary.
Azure.
virtualmachines.
User Requirements
Azure subscription.
Azure subscription.
Hotspot Question
You need to configure the Device settings to meet the technical requirements and the user
requirements.
Which two settings should you modify? To answer, select the appropriate settings in the answer
area.
Answer:
Explanation:
Box 1: Selected
Only selected users should be able to join devices
Box 2: Yes
Require Multi-Factor Auth to join devices.
From scenario:
Ensure that only users who are part of a group named Pilot can join devices to Azure AD Ensure
that when users join devices to Azure Active Directory (Azure AD), the users use a mobile phone
to verify their identity.
QUESTION 218
Overview
maintains.
- File servers
- A SQL database
- A web front end
only.
Requirements
Planned Changes
migration project.
backups.
tier.
temporary.
Azure.
virtualmachines.
User Requirements
Azure subscription.
Azure subscription.
Hotspot Question
You need to identify the storage requirements for Contoso.
Answer:
Explanation:
Box 1: Yes
Contoso is moving the existing product blueprint files to Azure Blob storage. Use unmanaged
standard storage for the hard disks of the virtual machines. We use Page Blobs for these.
Box 2: No
Box 3: No
QUESTION 219
Overview
Contoso, Ltd. is a consulting company that has a main office in Montreal and two branch offices
in Seattle and New York.
The Montreal office has 2,000 employees. The Seattle office has 1,000 employees. The New
York office has 200 employees.
All the resources used by Contoso are hosted on-premises.
Contoso creates a new Azure subscription. The Azure Active Directory (Azure AD) tenant
uses adomain named contoso.onmicrosoft.com. The tenant uses the P1 pricing tier.
The network contains an Active Directory forest named contoso.com. All domain controllers are
configured as DNS servers and host the contoso.com DNS zone.
Contoso has finance, human resources, sales, research, and information technology
departments. Each department has an organizational unit (OU) that contains all the accounts of
that respective department. All the user accounts have the department attribute set to their
respective department. New users are added frequently.
Contoso.com contains a user named User1.
All the offices connect by using private links.
Contoso has data centers in the Montreal and Seattle offices. Each data center has a firewall that
can be configured as a VPN device.
All infrastructure servers are virtualized.
The virtualization environment contains the servers in the following table.
Contoso uses two web applications named App1 and App2. Each instance on each web
application requires 1GB of memory.
The Azure subscription contains the resources in the following table.
The network security team implements several network security groups (NSGs).
Planned Changes
Contoso plans to implement the following changes:
- Deploy Azure ExpressRoute to the Montreal office.
- Migrate the virtual machines hosted on Server1 and Server2 to Azure.
- Synchronize on-premises Active Directory to Azure Active Directory
(Azure AD).
- Migrate App1 and App2 to two Azure web apps named WebApp1 and
WebApp2.
Technical requirements
- Ensure that WebApp1 can adjust the number of instances automatically
based on the load and can scale up to five instances.
- Ensure that VM3 can establish outbound connections over TCP port 8080
to the applications servers in the Montreal office.
- Ensure that routing information is exchanged automatically between
Azure and the routers in the Montreal office.
- Ensure Azure Multi-Factor Authentication (MFA) for the users in the
finance department only.
- Ensure that webapp2.azurewebsites.net can be accessed by using the
name app2.contoso.com
- Connect the New York office to VNet1 over the Internet by using an
encrypted connection.
- Create a workflow to send an email message when the settings of VM4
are modified.
- Create a custom Azure role named Role1 that is based on the Reader
role.
- Minimize costs whenever possible.
You discover that VM3 does NOT meet the technical requirements.
You need to verify whether the issue relates to the NSGs.
A. Diagram in VNet1
B. the security recommendations in Azure Advisor
C. Diagnostic settings in Azure Monitor
D. Diagnose and solve problems in Traffic Manager profiles
E. IP flow verify in Azure Network Watcher
Answer: E
Explanation:
Scenario: Contoso must meet technical requirements including:
Ensure that VM3 can establish outbound connections over TCP port 8080 to the applications
servers in the Montreal office.
consists of direction, protocol, local IP, remote IP, local port, and remote port. If the packet is
denied by a security group, the name of the rule that denied the packet is returned. While any
source or destination IP can be chosen, IP flow verify helps administrators quickly diagnose
connectivity issues from or to the internet and from or to the on-premises environment.
References:
QUESTION 220
Overview
Planned Changes
(Azure AD).
WebApp2.
are modified.
role.
You need to meet the technical requirement for VM4.
What should you create and configure?
A. an Azure Notification Hub
B. an Azure Event Hub
C. an Azure Logic App
D. an Azure Service Bus
Answer: B
Explanation:
Scenario: Create a workflow to send an email message when the settings of VM4 are modified.
You can start an automated logic app workflow when specific events happen in Azure resources
or third- party resources. These resources can publish those events to an Azure event grid. In
turn, the event grid pushes those events to subscribers that have queues, webhooks, or event
hubs as endpoints. As a subscriber, your logic app can wait for those events from the event grid
before running automated workflows to perform tasks - without you writing any code.
References:
https://docs.microsoft.com/en-us/azure/event-grid/monitor-virtual-machine-changes-event-grid-
logic-app
QUESTION 221
Overview
Planned Changes
(Azure AD).
WebApp2.
are modified.
role.
You need to recommend a solution to automate the configuration for the finance department
users. The solution must meet the technical requirements.
What should you include in the recommendation?
A. Azure AD B2C
B. Azure AD Identity Protection
C. an Azure logic app and the Microsoft Identity Management (MIM) client
D. dynamic groups and conditional access policies
Answer: D
Explanation:
Scenario: Ensure Azure Multi-Factor Authentication (MFA) for the users in the finance department
only.
The recommendation is to use conditional access policies that can then be targeted to groups of
users, specific applications, or other conditions.
References:
https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-userstates
QUESTION 222
Overview
Planned Changes
(Azure AD).
WebApp2.
are modified.
role.
Hotspot Question
You need to prepare the environment to implement the planned changes for Server2.
Answer:
Explanation:
Box 1: Create a Recovery Services vault
Create a Recovery Services vault on the Azure Portal.
Box 2: Install the Azure Site Recovery Provider
Azure Site Recovery can be used to manage migration of on-premises machines to Azure.
Scenario: Migrate the virtual machines hosted on Server1 and Server2 to Azure.
Server2 has the Hyper-V host role.
References:
https://docs.microsoft.com/en-us/azure/site-recovery/migrate-tutorial-on-premises-azure
QUESTION 223
Overview
Planned Changes
(Azure AD).
WebApp2.
are modified.
role.
Hotspot Question
You need to meet the connection requirements for the New York office.
Answer:
Explanation:
Box 1: Create a virtual network gateway and a local network gateway. Azure VPN gateway. The
VPN gateway service enables you to connect the VNet to the on-premises network through a
VPN appliance. For more information, see Connect an on-premises network to a Microsoft Azure
virtual network. The VPN gateway includes the following elements:
Virtual network gateway. A resource that provides a virtual VPN appliance for the VNet. It is
responsible for routing traffic from the on-premises network to the VNet. Local network gateway.
An abstraction of the on-premises VPN appliance. Network traffic from the cloud application to
the on-premises network is routed through this gateway. Connection. The connection has
properties that specify the connection type (IPSec) and the key shared with the on-premises VPN
appliance to encrypt traffic.
Gateway subnet. The virtual network gateway is held in its own subnet, which is subject to
various requirements, described in the Recommendations section below.
Box 2: Configure a site-to-site VPN connection
On premises create a site-to-site connection for the virtual network gateway and the local network
gateway.
Scenario: Connect the New York office to VNet1 over the Internet by using an encrypted
connection.
Incorrect Answers:
Azure ExpressRoute: Established between your network and Azure, through an ExpressRoute
partner. This connection is private. Traffic does not go over the internet.
References:
https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-
networking/vpn
QUESTION 224
Overview
Planned Changes
(Azure AD).
WebApp2.
are modified.
role.
Hotspot Question
You need to implement Role1.
Which command should you run before you create Role1? To answer, select the appropriate
Answer:
QUESTION 225
Case Study 4 - ADatum
Overview
ADatum Corporation is a financial company that has two main offices in New York and Los
Angeles. ADatum has a subsidiary named Fabrikam, Inc. that shares the Los Angeles office.
ADatum is conducting an initial deployment of Azure services to host new line-of-business

applications and is preparing to migrate its existing on-premises workloads to Azure.
ADatum uses Microsoft Exchange Online for email.
On-Premises Environment
The on-premises workloads run on virtual machines hosted in a VMware vSphere 6
infrastructure. All the virtual machines are members of an Active Directory forest named
adatum.com and run Windows Server 2016.
The New York office uses an IP address space of 10.0.0.0/16. The Los Angeles office uses an IP
address space of 10.10.0.0/16.
The offices connect by using a VPN provided by an ISP. Each office has one Azure
ExpressRoute circuit that provides access to Azure services and Microsoft Online Services.
Routing is implemented by using Microsoft peering.
The New York office has a virtual machine named VM1 that has the vSphere console installed.
Azure Environment
You provision the Azure infrastructure by using the Azure portal. The infrastructure contains the
resources shown in the following table.
AG1 has two backend pools named Pool11 and Pool12. AG2 has two backend pools named
Pool21 and Pool22.
Requirements
Planned Changes
ADatum plans to migrate the virtual machines from the New York office to the East US Azure
region by using Azure Site Recovery.
Infrastructure Requirements
ADatum identifies the following infrastructure requirements:
A new web app named App1 that will access third-parties for credit card processing must be
deployed.
A newly developed API must be implemented as an Azure function named App2. App2 will use
a blob storage trigger. App2 must process new blobs immediately.
The Azure infrastructure and the on-premises infrastructure must be prepared for the migration
of the VMware virtual machines to Azure.
The sizes of the Azure virtual machines that will be used to migrate the on-premises workloads
must be identified.
All migrated and newly deployed Azure virtual machines must be joined to the adatum.com
domain.
AG1 must load balance incoming traffic in the following manner:
- http://corporate.adatum.com/video/* will be load balanced across Pool11.
- http://corporate.adatum.com/images/* will be load balanced across Pool12.
- http://www.adatum.com will be load balanced across Pool21.
- http://fabrikam.com will be load balanced across Pool22.
ER1 must route traffic between the New York office and platform as a service (PaaS) services
in the East US Azure region, as long as ER1 is available.
ER1 must route traffic between the Los Angeles office and the PaaS services in the West US
region, as long as ER2 is available.
ER1 and ER2 must be configured to fail over automatically.
Application Requirements
App2 must be available to connect directly to the private IP addresses of the Azure virtual
machines. App2 will be deployed directly to an Azure virtual network.
Inbound and outbound communications to App1 must be controlled by using NSGs.
Pricing Requirements
ADatum identifies the following pricing requirements:
The cost of App1 and App2 must be minimized
The transactional charges of Azure Storage accounts must be minimized
You need to recommend an environment for the deployment of App1.
A. a new App Service plan that uses the P3v2 pricing tier
B. ASE1 and an App Service plan that uses the I1 pricing tier
C. ASE1 and an App Service plan that uses the I3 pricing tier
D. a new App Service plan that uses the S1 pricing tier
Answer: B
Explanation:
https://docs.microsoft.com/en-us/azure/app-service/environment/app-service-app-service-
environment-control-inbound-traffic
QUESTION 226
Overview

Azure Environment
Pool21 and Pool22.
Requirements
Planned Changes
deployed.
must be identified.
domain.
You need to configure AG1.

What should you create?
A. a multi-site listener
B. a URL path-based routing rule
C. a basic listener
D. a basic routing rule
Answer: B
Explanation:
https://docs.microsoft.com/en-us/azure/application-gateway/application-gateway-create-url-route-
portal
QUESTION 227
Overview

Azure Environment
Pool21 and Pool22.
Requirements
Planned Changes
deployed.
must be identified.
domain.
What should you create to configure AG2?
A. multi-site listeners
B. basic listeners
C. URL path-based routing rules
D. basic routing rules
E. an additional public IP address
Answer: A
Explanation:
-http://www.adatum.com will be load balanced across Pool21.
-http://fabrikam.com will be load balanced across Pool22.
You need to configure an Azure Application Gateway with multi-site listeners to direct different
URLs to different pools.
https://docs.microsoft.com/en-us/azure/application-gateway/multiple-site-overview
QUESTION 228
Overview

Azure Environment
Pool21 and Pool22.
Requirements
Planned Changes
deployed.
must be identified.
domain.
You need to identify the appropriate sizes for the Azure virtual machines.
Which five actions should you perform in sequence? To answer, move the appropriate actions
Answer:
Explanation:
https://docs.microsoft.com/en-us/azure/migrate/tutorial-assessment-vmware
QUESTION 229
Overview

Azure Environment
Pool21 and Pool22.
Requirements
Planned Changes
deployed.
must be identified.
domain.
Hotspot Question
You need to implement App2 to meet the application requirements.
What should you include in the implementation? To answer, select the appropriate options in the
answer area.
Answer:
Explanation:
A newly developed API must be implemented as an Azure function named App2.
App2 will use a blob storage trigger. App2 must process new blobs immediately.
This requires "Always On".
The Standard pricing tier is the cheapest tier that supports Always On.
QUESTION 230
Overview

Azure Environment
Pool21 and Pool22.
Requirements
Planned Changes
deployed.
must be identified.
domain.
You need to configure the Azure ExpressRoute circuits.
How should you configure Azure ExpressRoute routing? To answer, drag the appropriate
configurations to the correct locations. Each configuration may be used once, more than once, or
not at all. You may need to drag the split bar between panes or scroll to view content.
Answer:
QUESTION 231
Overview

Azure Environment
Pool21 and Pool22.
Requirements
Planned Changes
deployed.
must be identified.
domain.
Hotspot Question
You need to provision the resources in Azure to support the virtual machine that will be migrated
from the New York office.
What should you include in the solution? To answer, select the appropriate options in the answer
area.
Answer:
QUESTION 232
You have an Azure subscription that contains a resource group named RG26.
RG26 is set to the West Europe location and is used to create temporary resources for a project.
SQLDB01 is backed up to RGV1.
When the project is complete, you attempt to delete RG26 from the Azure portal. The deletion
fails.
You need to delete RG26.
A. Delete VM1
B. Stop VM1
C. Stop the backup of SQLDB01
D. Delete sa001
Answer: C
QUESTION 233
You have an Azure subscription named Subscription1 that contains a virtual network named
VNet1. VNet1 is in a resource group named RG1.
Subscription1 has a user named User1. User1 has the following roles:
- Reader
- Security Admin
- Security Reader
You need to ensure that User1 can assign the Reader role for VNet1 to other users.
What should you do?
A. Remove User 1 from the Security Reader role for Subscription1. Assign User1 the Contributor
role for RG1.
B. Assign User1 the Owner role for VNet1.
C. Remove User1 from the Security Reader and Reader roles for Subscription1.
D. Assign User1 the Network Contributor role for RG1.
Answer: B
Explanation:
Has full access to all resources including the right to delegate access to others.
Reference:
https://docs.microsoft.com/en-us/azure/role-based-access-control/overview
QUESTION 234
You have an Azure subscription that contains the storage accounts shown in the following table.
You need to identify which storage account can be converted to zone-redundant storage (ZRS)
replication by requesting a live migration from Azure support.
A. storage1
B. storage2
C. storage3
D. storage4
Answer: B
Explanation:
ZRS currently supports standard general-purpose v2, FileStorage and BlockBlobStorage storage
account types.
Incorrect Answers:
A, not C: Live migration is supported only for storage accounts that use LRS replication. If your
account uses GRS or RA-GRS, then you need to first change your account's replication type to
LRS before proceeding. This intermediary step removes the secondary endpoint provided by
GRS/RA-GRS.
Also, only standard storage account types support live migration. Premium storage accounts
must be migrated manually.
D: ZRS currently supports standard general-purpose v2, FileStorage and BlockBlobStorage
storage account types.
Reference:
QUESTION 235
You have an Azure subscription that contains a storage account named account1.
You plan to upload the disk files of a virtual machine to account1 from your on-premises network.
The on- premises network uses a public IP address space of 131.107.1.0/24.
You plan to use the disk files to provision an Azure virtual machine named VM1. VM1 will be
attached to a virtual network named VNet1. VNet1 uses an IP address space of 192.168.0.0/24.
You need to configure account1 to meet the following requirements:
- Ensure that you can upload the disk files to account1.

- Ensure that you can attach the disks to VM1.
- Prevent all other access to account1.
A. From the Firewalls and virtual networks blade of account1, select Selected networks.
B. From the Firewalls and virtual networks blade of account1, select Allow trusted Microsoft services
to access this storage account.
C. From the Firewalls and virtual networks blade of account1, add the 131.107.1.0/24 IP address
range.
D. From the Firewalls and virtual networks blade of account1, add VNet1.
E. From the Service endpoints blade of VNet1, add a service endpoint.
Answer: AE
Explanation:
A: By default, storage accounts accept connections from clients on any network. To limit access
to selected networks, you must first change the default action.
Azure portal
1. Navigate to the storage account you want to secure.
2. Click on the settings menu called Firewalls and virtual networks.
3. To deny access by default, choose to allow access from 'Selected networks'. To allow traffic
from all networks, choose to allow access from 'All networks'.
4. Click Save to apply your changes.
E: Grant access from a Virtual Network
Storage accounts can be configured to allow access only from specific Azure Virtual Networks.
By enabling a Service Endpoint for Azure Storage within the Virtual Network, traffic is ensured an
optimal route to the Azure Storage service. The identities of the virtual network and the subnet
are also transmitted with each request.
Reference:
https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security
QUESTION 236
correct solution.
You need to create an alert in Azure when more than two error events are logged to the System
event log on VM1 within an hour.
Solution: You create an Azure Log Analytics workspace and configure the data settings. You add
the Microsoft Monitoring Agent VM extension to VM1. You create an alert in Azure Monitor and
specify the Log Analytics workspace as the source.
A. Yes
B. No
Answer: B
Explanation:
Instead: You create an Azure Log Analytics workspace and configure the data settings. You
install the Microsoft Monitoring Agent on VM1. You create an alert in Azure Monitor and specify
the Log Analytics workspace as the source.
Reference:
https://docs.microsoft.com/en-us/azure/azure-monitor/platform/agents-overview
QUESTION 237
correct solution.
Solution: You create an Azure Log Analytics workspace and configure the data settings. You
A. Yes
B. No
Answer: A
Explanation:
Alerts in Azure Monitor can identify important information in your Log Analytics repository. They
are created by alert rules that automatically run log searches at regular intervals, and if results of
the log search match particular criteria, then an alert record is created and it can be configured to
perform an automated response.
The Log Analytics agent collects monitoring data from the guest operating system and workloads
of virtual machines in Azure, other cloud providers, and on-premises. It collects data into a Log
Analytics workspace.
Reference:
https://docs.microsoft.com/en-us/azure/azure-monitor/learn/tutorial-response
QUESTION 238
correct solution.
Solution: You create an Azure storage account and configure shared access signatures (SASs).
You install the Microsoft Monitoring Agent on VM1. You create an alert in Azure Monitor and
specify the storage account as the source.
A. Yes
B. No
Answer: B
Explanation:
Reference:
QUESTION 239
correct solution.
You have an Azure subscription that contains the resources shown in the following table.
VM1 connects to VNET1.
You need to connect VM1 to VNET2.
Solution: You move VM1 to RG2, and then you add a new network interface to VM1.
A. Yes
B. No
Answer: B
Explanation:
Instead you should delete VM1. You recreate VM1, and then you add the network interface for
VM1.
Note: When you create an Azure virtual machine (VM), you must create a virtual network (VNet)
or use an existing VNet. You can change the subnet a VM is connected to after it's created, but
you cannot change the VNet.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-machines/windows/network-overview
QUESTION 240
correct solution.
Solution: You delete VM1. You recreate VM1, and then you create a new network interface for
VM1 and connect it to VNET2.
A. Yes
B. No
Answer: A
Explanation:
You should delete VM1. You recreate VM1, and then you add the network interface for VM1.
Reference:
QUESTION 241
correct solution.
Solution: You turn off VM1, and then you add a new network interface to VM1.
A. Yes
B. No
Answer: B
Explanation:
Instead you should delete VM1. You recreate VM1, and then you add the network interface for
VM1.
Reference:
QUESTION 242
You deploy an Azure Kubernetes Service (AKS) cluster named Cluster1 that uses the IP
addresses shown in the following table.
You need to provide internet users with access to the applications that run in Cluster1.
Which IP address should you include in the DNS record for Cluster1?
A. 131.107.2.1
B. 10.0.10.11
C. 172.17.7.1
D. 192.168.10.2
Answer: A
QUESTION 243
You have a deployment template named Template1 that is used to deploy 10 Azure web apps.
You need to identify what to deploy before you deploy Template1. The solution must minimize
Azure costs.
A. five Azure Application Gateways

B. one App Service plan
C. 10 App Service plans
D. one Azure Traffic Manager
E. one Azure Application Gateway
Answer: B
Explanation:
You create Azure web apps in an App Service plan.
Reference:
https://docs.microsoft.com/en-us/azure/app-service/overview-hosting-plans
QUESTION 244
business application that is available 24 hours a day. VM1 has one network interface and one
managed disk. VM1 uses the D4s v3 size.
- Change the size to D8s v3.

- Add a 500-GB managed disk.
- Add the Puppet Agent extension.
- Enable Desired State Configuration Management.
A. Enable Desired State Configuration Management

B. Add a 500-GB managed disk
C. Change the size to D8s v3
D. Add the Puppet Agent extension
Answer: C
Explanation:
Reference:
https://azure.microsoft.com/en-us/blog/resize-virtual-machines/
QUESTION 245
You have an app named App1 that runs on an Azure web app named webapp1.
The developers at your company upload an update of App1 to a Git repository named Git1.
Webapp1 has the deployment slots shown in the following table.
You need to ensure that the App1 update is tested before the update is made available to users.
A. Swap the slots

B. Deploy the App1 update to webapp1-prod, and then test the update
C. Stop webapp1-prod
D. Deploy the App1 update to webapp1-test, and then test the update
E. Stop webapp1-test
Answer: AD
QUESTION 246
You have an Azure subscription named Subscription1 that has the following providers registered:
Authorization
Automation
Resources
Compute
KeyVault
Network
Storage
Billing
Web
Subscription1 contains an Azure virtual machine named VM1 that has the following
configurations:
Private IP address: 10.0.0.4 (dynamic)

Network security group (NSG): NSG1
Public IP address: None
Availability set: AVSet
Subnet: 10.0.0.0/24
Managed disks: No
Location: East US
You need to record all the successful and failed connection attempts to VM1.
A. Enable Azure Network Watcher in the East US Azure region.

B. Add an Azure Network Watcher connection monitor.
C. Register the MicrosoftLogAnalytics provider.
D. Create an Azure Storage account.
E. Register the Microsoft.Insights resource provider.
F. Enable Azure Network Watcher flow logs.
Answer: ACD
Explanation:
D: NSG flow log data is written to an Azure Storage account. You need to create an Azure
Storage account,
With an Azure Storage account NSG flow logs can be enabled.
A: Enable network watcher in the East US region.
C: NSG flow logging requires the Microsoft.Insights provider.
Reference:
https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-nsg-flow-logging-portal
QUESTION 247
You need to deploy an Azure virtual machine scale set that contains five instances as quickly as
possible.
What should you do?
A. Deploy five virtual machines. Modify the Availability Zones settings for each virtual machine.
B. Deploy five virtual machines. Modify the Size setting for each virtual machine.
C. Deploy one virtual machine scale set that is set to VM (virtual machines) orchestration mode.
D. Deploy one virtual machine scale set that is set to ScaleSetVM orchestration mode.
Answer: D
Explanation:
https://docs.microsoft.com/en-us/azure/virtual-machine-scale-sets/orchestration-modes
QUESTION 248
You plan to create the Azure web apps shown in the following table.
What is the minimum number of App Service plans you should create for the web apps?
A. 1
B. 2
C. 3
D. 4
Answer: B
Explanation:
It is possible to add more than one web app with different runtime stacks to the same app service
plan, if the runtime stack is supported on the given operating system type.
.NET Core 3.0 -> supported on Windows and Linux
ASP .NET V4.7 -> Windows only
PHP -> Windows and Linux
Ruby 2.6 -> Linux only
So the minimum number of app service plans should be 2.
QUESTION 249
Your company has three offices. The offices are located in Miami, Los Angeles, and New York.
Each office contains datacenter.
You have an Azure subscription that contains resources in the East US and West US Azure
regions. Each region contains a virtual network. The virtual networks are peered.
You need to connect the datacenters to the subscription. The solution must minimize network
latency between the datacenters.
A. three Azure Application Gateways and one On-premises data gateway

B. three virtual hubs and one virtual WAN
C. three virtual WANs and one virtual hub
D. three On-premises data gateways and one Azure Application Gateway
Answer: C
Explanation:
https://docs.microsoft.com/en-us/azure/virtual-wan/virtual-wan-about
QUESTION 250
You have an Azure subscription that contains two virtual networks named VNet1 and VNet2.
Virtual machines connect to the virtual networks.
The virtual networks have the address spaces and the subnets configured as shown in the
following table.
You need to add the address space of 10.33.0.0/16 to VNet1. The solution must ensure that the
hosts on VNet1 and VNet2 can communicate.
Answer:
Explanation:
Step 1: Remove peering between Vnet1 and VNet2.
You can't add address ranges to, or delete address ranges from a virtual network's address
space once a virtual network is peered with another virtual network. To add or remove address
ranges, delete the peering, add or remove the address ranges, then re-create the peering.
Step 2: Add the 10.44.0.0/16 address space to VNet1.
Step 3: Recreate peering between VNet1 and VNet2
Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-manage-peering
QUESTION 251
You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains
four subnets named Gateway, Perimeter, NVA, and Production.
The NVA subnet contains two network virtual appliances (NVAs) that will perform network traffic
inspection between the Perimeter subnet and the Production subnet.
You need to implement an Azure load balancer for the NVAs. The solution must meet the
following requirements:
- The NVAs must run in an active-active configuration that uses

automatic failover.
- The NVA must load balance traffic to two services on the Production
subnet. The services have different IP addresses.
A. Deploy a basic load balancer

B. Deploy a standard load balancer
C. Add two load balancing rules that have HA Ports and Floating IP enabled
D. Add two load balancing rules that have HA Ports enabled and Floating IP disabled
E. Add a frontend IP configuration, a backend pool, and a health probe
F. Add a frontend IP configuration, two backend pools, and a health probe
Answer: BCF
Explanation:
A standard load balancer is required for the HA ports.
Two backend pools are needed as there are two services with different IP addresses.
Floating IP rule is used where backend ports are reused.
Incorrect Answers:
E: HA Ports are not available for the basic load balancer.
Reference:
https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-standard-overview
https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-multivip-overview
QUESTION 252
named VNet1 and VNet2. VNet1 contains a VPN gateway named VPNGW1 that uses static
routing. There is a site-to-site VPN connection between your on-premises network and VNet1.
On a computer named Client1 that runs Windows 10, you configure a point-to-site VPN
connection to VNet1.
You configure virtual network peering between VNet1 and VNet2. You verify that you can connect
to VNet2 from the on-premises network. Client1 is unable to connect to VNet2.
What should you do?
A. Download and re-install the VPN client configuration package on Client1.

B. Select Allow gateway transit on VNet1.
D. Enable BGP on VPNGW1
Answer: A
Explanation:
QUESTION 253

B. the subnets on VNet2 and VNet3 only
C. the subnets on VNet2 only
D. the subnets on VNet3 only
E. the subnets on VNet1, VNet2, and VNet3
Answer: D
Explanation:
All Azure resources are created in an Azure region and subscription. A resource can only be
created in a virtual network that exists in the same region and subscription as the resource.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-vnet-plan-design-arm
QUESTION 254
Hotspot Question
You have Azure Active Directory tenant named Contoso.com that includes following users:
Contoso.com includes following Windows 10 devices:
You create following security groups in Contoso.com:
Answer:
Explanation:
Box 1: Yes
User1 is a Cloud Device Administrator.
Device2 is Azure AD joined.
Group1 has the assigned to join type. User1 is the owner of Group1.
Note: Assigned groups - Manually add users or devices into a static group. Azure AD joined or
hybrid Azure AD joined devices utilize an organizational account in Azure AD Box 2: No
User2 is a User Administrator.
Device1 is Azure AD registered.
Group1 has the assigned join type, and the owner is User1.
Note: Azure AD registered devices utilize an account managed by the end user, this account is
either a Microsoft account or another locally managed credential.
Box 3: Yes
Group2 has the Dynamic Device join type, and the owner is User2.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/devices/overview
QUESTION 255
Hotspot Question
You plan to copy an on-premises virtual machine image to a container named vmimages.
You need to create the container for the planned image.
Which command should you run? To answer, select the appropriate options in the answer area.
Answer:
QUESTION 256
Hotspot Question
You have an Azure File sync group that has the endpoints shown in the following table.
Cloud tiering is enabled for Endpoint3.
You add a file named File1 to Endpoint1 and a file named File2 to Endpoint2.
On which endpoints will File1 and File2 be available within 24 hours of adding the files? To
answer, select the appropriate options in the answer area.
Answer:
Explanation:
File1: Endpoint3 only
Cloud Tiering: A switch to enable or disable cloud tiering. When enabled, cloud tiering will tier
files to your Azure file shares. This converts on-premises file shares into a cache, rather than a
complete copy of the dataset, to help you manage space efficiency on your server. With cloud
tiering, infrequently used or accessed files can be tiered to Azure Files.
File2: Endpoint1, Endpoint2, and Endpoint3
Reference:
https://docs.microsoft.com/en-us/azure/storage/files/storage-sync-cloud-tiering
QUESTION 257
Hotspot Question
You have several Azure virtual machines on a virtual network named VNet1.
You configure an Azure Storage account as shown in the following exhibit.
Answer:
Explanation:
Box 1: always
Endpoint status is enabled.
Box 2: Never
After you configure firewall and virtual network settings for your storage account, select Allow
trusted Microsoft services to access this storage account as an exception to enable Azure
Backup service to access the network restricted storage account.
Reference:
https://azure.microsoft.com/en-us/blog/azure-backup-now-supports-storage-accounts-secured-
with-azure-storage-firewalls-and-virtual-networks/
QUESTION 258
Hotspot Question
You have a sync group named Sync1 that has a cloud endpoint. The cloud endpoint includes a
file named File1.txt.
Your on-premises network contains servers that run Windows Server 2016. The servers are
configured as shown in the following table.
You add Share1 as an endpoint for Sync1. One hour later, you add Share2 as an endpoint for
Sync1.
Answer:
Explanation:
Box 1: Yes
If you add an Azure file share that has an existing set of files as a cloud endpoint to a sync group,
the existing files are merged with any other files that are already on other endpoints in the sync
group.
Box 2: No
Box 3: Yes
Reference:
https://docs.microsoft.com/en-us/azure/storage/files/storage-sync-files-planning
QUESTION 259
Hotspot Question
You have an Azure subscription named Subscription1 that contains the quotas shown in the
following table.
You deploy virtual machine to Subscription1 as shown in the following table.
You plan to deploy the virtual machines shown in the following table.
Answer:
Explanation:
The total regional vCPUs is 20 so that means a maximum total of 20 vCPUs across all the
different VM sizes. The deallocated VM with 16 vCPUs counts towards the total. VM20 and VM1
are using 18 of the maximum 20 vCPUs leaving only two vCPUs available.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-machines/windows/quotas
QUESTION 260
Hotspot Question
You have an Azure subscription that contains an Azure Availability Set named WEBPROD-AS-
USE2 as shown in the following exhibit.
You add 14 virtual machines to WEBPROD-AS-USE2.
Answer:
Explanation:
Box 1: 2
There are 10 update domains. The 14 VMs are shared across the 10 update domains so four
update domains will have two VMs and six update domains will have one VM. Only one update
domain is rebooted at a time. Therefore, a maximum of two VMs will be offline.
Box 2: 7
There are 2 fault domains. The 14 VMs are shared across the 2 fault domains, so 7 VMs in each
fault domain. A rack failure will affect one fault domain so 7 VMs will be offline.
Reference:
QUESTION 261
Hotspot Question
You plan to deploy an Azure container instance by using the following Azure Resource Manager
template.
the information presented in the template.
Answer:
QUESTION 262
Hotspot Question
You have a pay-as-you-go Azure subscription that contains the virtual machines shown in the
following table.
You create the budget shown in the following exhibit.
The AG1 action group contains a user named admin@contoso.com only.
Answer:
Explanation:
Box 1: VM1 is turned off, and VM2 continues to run
The budget alerts are for Resource Group RG1, which include VM1, but not VM2.
Box 2: one email notification will be sent each month.

Budget alerts for Resource Group RG1, which include VM1, but not VM2.VM1 consumes 20
Euro/day. The 50%, 500 Euro limit, will be reached in 25 days, and an email will be sent.
The 70% and 100% alert conditions will not be reached within a month, and they don't trigger
email actions anyway.
Credit alerts: Credit alerts are generated automatically at 90% and at 100% of your Azure credit
balance. Whenever an alert is generated, it's reflected in cost alerts and in the email sent to the
account owners.
90% and 100% will not be reached though.
Reference:
https://docs.microsoft.com/en-us/azure/cost-management-billing/costs/cost-mgt-alerts-monitor-
usage-spending
QUESTION 263
Hotspot Question
You have an Azure subscription named Sub1.
You plan to deploy a multi-tiered application that will contain the tiers shown in the following table.
You need to recommend a networking solution to meet the following requirements:
- Ensure that communication between the web servers and the business
logic tier spreads equally across the virtual machines.
- Protect the web servers from SQL injection attacks.
Which Azure resource should you recommend for each requirement? To answer, select the
NOTE: Each correct selection is worth one point
Answer:
Explanation:
Box 1: an internal load balancer
Azure Internal Load Balancer (ILB) provides network load balancing between virtual machines
that reside inside a cloud service or a virtual network with a regional scope.
Box 2: an application gateway that uses the WAF tier

Azure Web Application Firewall (WAF) on Azure Application Gateway provides centralized
protection of your web applications from common exploits and vulnerabilities. Web applications
are increasingly targeted by malicious attacks that exploit commonly known vulnerabilities.
Reference:
https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/ag-overview
QUESTION 264
Hotspot Question
You have an Azure virtual network named VNet1 that connects to your on-premises network by
using a site-to-site VPN. VNet1 contains one subnet named Sunet1.
Subnet1 is associated to a network security group (NSG) named NSG1. Subnet1 contains a
basic internal load balancer named ILB1. ILB1 has three Azure virtual machines in the backend
pool.
You need to collect data about the IP addresses that connects to ILB1. You must be able to run
interactive queries from the Azure portal against the collected data.
Answer:
Explanation:
Box 1: An Azure Log Analytics workspace
In the Azure portal you can set up a Log Analytics workspace, which is a unique Log Analytics
environment with its own data repository, data sources, and solutions
Box 2: ILB1
Reference:
https://docs.microsoft.com/en-us/azure/log-analytics/log-analytics-quick-create-workspace
https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-standard-diagnostics
QUESTION 265
Overview
maintains.
- File servers
- A SQL database
- A web front end
only.
Requirements
Planned Changes
migration project.
backups.
tier.
temporary.
Azure.
virtualmachines.
User Requirements
Azure subscription.
Azure subscription.
Hotspot Question
What should you include in the recommendation? To answer, select the appropriate options in
the answer area.
Answer:
Explanation:
This reference architecture shows how to deploy VMs and a virtual network configured for an N-
tier application, using SQL Server on Windows for the data tier.
Scenario: You have a public-facing application named App1. App1 is comprised of the following
three tiers:
A SQL database
A web front end
only.

Minimize the number of open ports between the App1 tiers.
Reference:
QUESTION 266
Overview
Planned Changes
(Azure AD).
WebApp2.
are modified.
role.
You need to recommend a solution to automate the configuration for the finance department
users. The solution must meet the technical requirements.
A. Azure AD B2C
B. dynamic groups and conditional access policies
C. Azure AD Identity Protection
D. an Azure logic app and the Microsoft Identity Management (MIM) client
Answer: B
Explanation:
only.
Reference:
QUESTION 267
Overview
Planned Changes
(Azure AD).
WebApp2.
are modified.
role.
Hotspot Question
Answer:
Explanation:
Box 1: Create a virtual network gateway and a local network gateway. Azure VPN gateway. The
VPN gateway service enables you to connect the VNet to the on-premises network through a
VPN appliance. For more information, see Connect an on-premises network to a Microsoft Azure
Virtual network gateway. A resource that provides a virtual VPN appliance for the VNet. It is
responsible for routing traffic from the on-premises network to the VNet. Local network gateway.
An abstraction of the on-premises VPN appliance. Network traffic from the cloud application to
the on-premises network is routed through this gateway. Connection. The connection has
properties that specify the connection type (IPSec) and the key shared with the on-premises VPN
appliance to encrypt traffic. Gateway subnet. The virtual network gateway is held in its own
subnet, which is subject to various requirements, described in the Recommendations section
below.

gateway.
Scenario: Connect the New York office to VNet1 over the Internet by using an encrypted
connection.
Incorrect Answers:
Reference:
networking/vpn
QUESTION 268
Overview
Planned Changes
(Azure AD).
WebApp2.
are modified.
role.
Hotspot Question
Which command should you run before you create Role1? To answer, select the appropriate
Answer:
QUESTION 269
You have an Azure subscription named Subscription1 that contains an Azure Log Analytics
workspace named Workspace1.
You need to view the error from a table named Event.
Which query should you run in Workspace1?
A. Get-Event Event | where {$_. EventType == "error"}

B. Event | search "error"
C. select * from Event where EnventType == "error"
D. Event | where EventType is "error"
Answer: B
Explanation:
https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/search-queries
https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/get-started-portal
QUESTION 270
You have an Azure subscription named Subscription1. Subscription1 contains the resource
groups in the following table.
RG1 has a web app named WebApp1. WebApp1 is located in West Europe.
You move WebApp1 to RG2.
What is the effect of the move?
A. The App Service plan for WebApp1 remains in West Europe. Policy2 applies to WebApp1.
B. The App Service plan for WebApp1 moves to North Europe. Policy2 applies to WebApp1.
C. The App Service plan for WebApp1 remains in West Europe. Policy1 applies to WebApp1.
D. The App Service plan for WebApp1 moves to North Europe. Policy1 applies to WebApp1.
Answer: A
Explanation:
You can move an app to another App Service plan, as long as the source plan and the target plan
are in the same resource group and geographical region.
The region in which your app runs is the region of the App Service plan it's in. However, you
cannot change an App Service plan's region.
Reference:
QUESTION 271
Users access the resources in the subscription from either home or from customer sites. From
home, users must establish a point-to-site VPN to access the Azure resources. The users on the
customer sites access the Azure resources by using site-to-site VPNs.
You have a line-of-business-app named App1 that runs on several Azure virtual machine. The
virtual machines run Windows Server 2016.
What are two possible Azure services that you can use? Each correct answer presents a
complete solution.
A. an internal load balancer

B. a public load balancer
D. Traffic Manager
Answer: A
Explanation:
Line-of-business apps are custom apps that are used by internal staff members.
QUESTION 272
You have 100 Azure virtual machines.
You need to quickly identify underutilized virtual machines that can have their service tier
changed to a less expensive offering.
Which blade should you use?
A. Monitor
B. Advisor
C. Metrics
D. Customer insights
Answer: B
Explanation:
Advisor helps you optimize and reduce your overall Azure spend by identifying idle and
underutilized resources. You can get cost recommendations from the Cost tab on the Advisor
dashboard.
Reference:
https://docs.microsoft.com/en-us/azure/advisor/advisor-cost-recommendations
QUESTION 273
You have Azure subscription that includes data in following locations:
You plan to export data by using Azure import/export job named Export1.
You need to identify the data that can be exported by using Export1.
Which data should you identify?
A. DB1
B. container1
C. Share1
D. Table1
Answer: C
Explanation:
Azure Import/Export service is used to securely import large amounts of data to Azure Blob
storage and Azure Files by shipping disk drives to an Azure datacenter.
Reference:
QUESTION 274
Store1 contains a file share named data. Data contains 5,000 files.
You need to synchronize the files in the file share named data to an on-premises server named
Server1.
A. Create a container instance

B. Register Server1
C. Install the Azure File Sync agent on Server1
D. Download an automation script
E. Create a sync group
Answer: BCE
Explanation:
Step 1 (C): Install the Azure File Sync agent on Server1 The Azure File Sync agent is a
downloadable package that enables Windows Server to be synced with an Azure file share
Step 2 (B): Register Server1.
Step 3 (E): Create a sync group and a cloud endpoint.
registered server.
Reference:
QUESTION 275
template will be used to deploy 100 virtual machines.
You need to modify the template to reference an administrative password. You must prevent the
password from being stored in plain text.
A. an Azure Key Vault and an access policy

B. an Azure Storage account and an access policy
C. a Recovery Services vault and a backup policy
D. Azure Active Directory (AD) Identity Protection and an Azure policy
Answer: A
Explanation:
You can use a template that allows you to deploy a simple Windows VM by retrieving the
password that is stored in a Key Vault. Therefore, the password is never put in plain text in the
template parameter file.
Reference:
https://azure.microsoft.com/en-us/resources/templates/101-vm-secure-password/
QUESTION 276
You plan to automate the deployment of a virtual machine scale set that uses the Windows
Server 2016 Datacenter image.
You need to ensure that when the scale set virtual machines are provisioned, they have web
server components installed.
A. Upload a configuration script

B. Create an automation account
C. Create an Azure policy
D. Modify the extensionProfile section of the Azure Resource Manager template
E. Create a new virtual scale set in the Azure portal
Answer: DE
Explanation:
Virtual Machine Scale Sets can be used with the Azure Desired State Configuration (DSC)
extension handler. Virtual machine scale sets provide a way to deploy and manage large
numbers of virtual machines, and can elastically scale in and out in response to load. DSC is
used to configure the VMs as they come online so they are running the production software.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-dsc
QUESTION 277
You have an Azure Resource Manager template named Template1 that is used to deploy an
Azure virtual machine.
Template1 contains the following text:
The variables section in Template1 contains the following text:
"location": "westeurope"
The resources section in Template1 contains the following text:
You need to deploy the virtual machine to the West US location by using Template1.
What should you do?
A. Modify the location in the resource section to westus

B. Select West US during the deployment
C. Modify the location in the variables section to westus
Answer: A
QUESTION 278
You create an App Service plan named Plan1 and an Azure web app named webapp1.
You discover that the option to create a staging slot is unavailable.
You need to create a staging slot for Plan1.
A. From Plan1, scale up the App Service plan

B. From webapp1, modify the Application settings
C. From webapp1, add a custom domain
D. From Plan1, scale out the App Service plan
Answer: A
Explanation:
The app must be running in the Standard, Premium, or Isolated tier in order for you to enable
multiple deployment slots.
If the app isn't already in the Standard, Premium, or Isolated tier, you receive a message that
indicates the supported tiers for enabling staged publishing. At this point, you have the option to
select Upgrade and go to the Scale tab of your app before continuing.
Scale up: Get more CPU, memory, disk space, and extra features like dedicated virtual machines
(VMs), custom domains and certificates, staging slots, autoscaling, and more.
Incorrect:
Scale out: Increase the number of VM instances that run your app. You can scale out to as many
as 30 instances
Reference:
https://docs.microsoft.com/en-us/azure/app-service/manage-scale-up
QUESTION 279
You plan to move a distributed on-premises app named App1 to an Azure subscription.
After the planned move, App1 will be hosted on several Azure virtual machines.
You need to ensure that App1 always runs on at least eight virtual machines during planned
Azure maintenance.
A. one virtual machine scale set that has 10 virtual machines instances
B. one Availability Set that has three fault domains and one update domain
C. one Availability Set that has 10 update domains and one fault domain
D. one virtual machine scale set that has 12 virtual machines instances
Answer: C
Explanation:
An update domain is a logical group of underlying hardware that can undergo maintenance or be
rebooted at the same time. As you create VMs within an availability set, the Azure platform
automatically distributes your VMs across these update domains. This approach ensures that at
least one instance of your application always remains running as the Azure platform undergoes
periodic maintenance.
Reference:
http://www.thatlazyadmin.com/azure-fault-update-domains/
QUESTION 280
correct solution.
Solution: You create an event subscription on VM1. You create an alert in Azure Monitor and
specify VM1 as the source
A. Yes
B. No
Answer: B
Explanation:
Reference:
QUESTION 281
correct solution.
A. Yes
B. No
Answer: B
Explanation:
You would need to redeploy the VM.
Reference:
QUESTION 282
correct solution.
A. Yes
B. No
Answer: A
Explanation:
References:
QUESTION 283
correct solution.
Solution: From the Update management blade, you click Enable.
A. Yes
B. No
Answer: B
Explanation:
Reference:
QUESTION 284
You have a virtual network named VNET1 and an Azure virtual machine named VM1 that hosts a
MySQL database. VM1 connects to VNET1.
You need to ensure that webapp1 can access the data hosted on VM1.
What should you do?
A. Deploy an internal load balancer

B. Peer VNET1 to another virtual network
C. Connect webapp1 to VNET1
D. Deploy an Azure Application Gateway
Answer: D
QUESTION 285
correct solution.
You have a computer named Computer1 that has a point-to-site VPN connection to an Azure
virtual network named VNet1. The point-to-site connection uses a self-signed certificate.
From Azure, you download and install the VPN client configuration package on a computer
named Computer2.
You need to ensure that you can establish a point-to-site VPN connection to VNet1 from
Computer2.
Solution: You modify the Azure Active Directory (Azure AD) authentication policies.
A. Yes
B. No
Answer: B
Explanation:
Instead export the client certificate from Computer1 and install the certificate on Computer2.
Note:
Each client computer that connects to a VNet using Point-to-Site must have a client certificate
installed.
You generate a client certificate from the self-signed root certificate, and then export and install
the client certificate. If the client certificate is not installed, authentication fails.
Reference:
https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-certificates-point-to-site
QUESTION 286
correct solution.
You have a computer named Computer1 that has a point-to-site VPN connection to an Azure
virtual network named VNet1. The point-to-site connection uses a self-signed certificate.
From Azure, you download and install the VPN client configuration package on a computer
named Computer2.
You need to ensure that you can establish a point-to-site VPN connection to VNet1 from
Computer2.
Solution: You join Computer2 to Azure Active Directory (Azure AD)
A. Yes
B. No
Answer: B
Explanation:
A client computer that connects to a VNet using Point-to-Site must have a client certificate
installed.
Reference:
QUESTION 287
correct solution.
A. Yes
B. No
Answer: B
QUESTION 288
named VM1.
Internet.
You add a network interface named vm1173 to VM1 as shown in the exhibit. (Click the Exhibit
tab.)
fails.
A. Change the priority of the RDP rule

B. Attach a network interface
C. Delete the DenyAllInBound rule
D. Start VM1
Answer: D
Explanation:
Incorrect Answers:
A: Rules are processed in priority order, with lower numbers processed before higher numbers,
because lower numbers have higher priority. Once traffic matches a rule, processing stops. RDP
already has the lowest number and thus the highest priority.
Reference:
QUESTION 289
A DNS service is installed on VM1.
You configure the DNS servers settings for each virtual network as shown in the following exhibit.
You need to ensure that all the virtual machines can resolve DNS names by using the DNS
service on VM1.
What should you do?
A. Configure a conditional forwarder on VM1

B. Add service endpoints on VNET1
C. Add service endpoints on VNET2 and VNET3
D. Configure peering between VNET1, VNET2, and VNET3
Answer: D
Explanation:
Virtual network peering enables you to seamlessly connect networks in Azure Virtual Network.
The virtual networks appear as one for connectivity purposes. The traffic between virtual
machines uses the Microsoft backbone infrastructure.
Incorrect Answers:
B, C: Virtual Network (VNet) service endpoint provides secure and direct connectivity to Azure
services over an optimized route over the Azure backbone network. Endpoints allow you to
secure your critical Azure service resources to only your virtual networks. Service Endpoints
enables private IP addresses in the VNet to reach the endpoint of an Azure service without
needing a public IP address on the VNet.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview
https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview
QUESTION 290
You have the Azure virtual network named VNet1 that contains a subnet named Subnet1.
Subnet1 contains three Azure virtual machines. Each virtual machine has a public IP address.
The virtual machines host several applications that are accessible over port 443 to users on the
Internet.
Your on-premises network has a site-to-site VPN connection to VNet1.
You discover that the virtual machines can be accessed by using the Remote Desktop Protocol
(RDP) from the Internet and from the on-premises network.
You need to prevent RDP access to the virtual machines from the Internet, unless the RDP
connection is established from the on-premises network. The solution must ensure that all the
applications can still be accessed by the Internet users.
What should you do?
A. Modify the address space of the local network gateway

B. Create a deny rule in a network security group (NSG) that is linked to Subnet1
C. Remove the public IP addresses from the virtual machines
D. Modify the address space of Subnet1
Answer: B
Explanation:
You can use a site-to-site VPN to connect your on-premises network to an Azure virtual network.
Users on your on-premises network connect by using the RDP or SSH protocol over the site-to-
site VPN connection.
You don't have to allow direct RDP or SSH access over the internet.
Reference:
https://docs.microsoft.com/en-us/azure/security/fundamentals/network-best-practices
QUESTION 291
What should you do?
A. Associate NIC1 to ASG1

B. Modify the properties of ASG1
C. Modify the properties of NSG1
Answer: A
Explanation:
Application Security Group can be associated with NICs.
References:
https://docs.microsoft.com/en-us/azure/virtual-network/security-overview#application-security-
groups
QUESTION 292
You have an Azure subscription named Subscription1 that contains an Azure virtual network
named VNet1. VNet1 connects to your on-premises network by using Azure ExpressRoute.
You plan to prepare the environment for automatic failover in case of ExpressRoute failure.
must minimize cost.
A. Create a connection
B. Create a local site VPN gateway
C. Create a VPN gateway that uses the VpnGw1 SKU
D. Create a gateway subnet
E. Create a VPN gateway that uses the Basic SKU
Answer: ADE
Explanation:
manager-portal
QUESTION 293
Your company has a main office in London that contains 100 client computers.
Three years ago, you migrated to Azure Active Directory (Azure AD).
The company's security policy states that all personal devices and corporate-owned devices must
be registered or joined to Azure AD.
A remote user named User1 is unable to join a personal device to Azure AD from a home
network.
You verify that User1 was able to join devices to Azure AD in the past.
You need to ensure that User1 can join the device to Azure AD.
What should you do?
A. Assign the User administrator role to User1.

B. From the Device settings blade, modify the Maximum number of devices per user setting.
C. Create a point-to-site VPN from the home network of User1 to Azure.
D. From the Device settings blade, modify the Users may join devices to Azure AD setting.
Answer: B
Explanation:
The Maximum number of devices setting enables you to select the maximum number of devices
that a
user can have in Azure AD. If a user reaches this quota, they will not be able to add additional
devices until one or more of the existing devices are removed.
Incorrect Answers:
C: Azure AD Join enables users to join their devices to Active Directory from anywhere as long as
they have connectivity with the Internet.
D: The Users may join devices to Azure AD setting enables you to select the users who can join
devices to Azure AD. Options are All, Selected and None. The default is All.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/devices/device-management-azure-portal
http://techgenix.com/pros-and-cons-azure-ad-join/
QUESTION 294
correct solution.
A. Yes
B. No
Answer: A
Explanation:
Reference:
QUESTION 295
Hotspot Question
You have an Azure subscription that contains a virtual network named VNET1 in the East US 2
region.
You have the following resources in an Azure Resource Manager template.
Answer:
Explanation:
Box 1: Yes
Box 2: Yes
VM1 is in Zone1, while VM2 is on Zone2.
Box 3: No
Reference:
https://docs.microsoft.com/en-us/azure/architecture/resiliency/recovery-loss-azure-region
QUESTION 296
Hotspot Question
You have an Azure subscription named Subscription1 that has a subscription ID of c276fc76-
9cd4-44c9- 99a7-4fd71546436e.
You need to create a custom RBAC role named CR1 that meets the following requirements:
- Can be assigned only to the resource groups in Subscription1
- Prevents the management of the access permissions for the resource
groups
- Allows the viewing, creating, modifying, and deleting of resources
within the resource groups
What should you specify in the assignable scopes and the permission elements of the definition
of CR1? To answer, select the appropriate options in the answer area.
Answer:
Explanation:
https://docs.microsoft.com/en-us/azure/role-based-access-control/custom-roles
https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-
operations#microsoftresources
QUESTION 297
Hotspot Question
You have Azure Storage accounts as shown in the following exhibit.
Answer:
Explanation:
General- purpose v1 (GPv1) accounts, and Blob storage accounts.
General-purpose v2 (GPv2) accounts are storage accounts that support all of the latest features
for blobs, files, queues, and tables.
Blob storage accounts support all the same block blob features as GPv2, but are limited to
General-purpose v1 (GPv1) accounts provide access to all Azure Storage services, but may not
Reference:
https://docs.microsoft.com/en-us/azure/storage/common/storage-account-options
QUESTION 298
Hotspot Question
You have an Azure Service app named App1 and an app named App2 that runs in an Azure
container instance. Each app uses a managed identity.
You need to ensure that App1 and App2 can read blobs from storage1. The solution must meet
the following requirements:
- Minimize the number of secrets used.

- Ensure that App2 can only read from storage1 for the next 30 days.
What should you configure in storage1 for each app? To answer, select the appropriate options in
the answer area.
Answer:
Explanation:
App1: Access keys
App2: Shared access signature (SAS)

A shared access signature (SAS) provides secure delegated access to resources in your storage
account without compromising the security of your data. With a SAS, you have granular control
over how a client can access your data. You can control what resources the client may access,
what permissions they have on those resources, and how long the SAS is valid, among other
parameters.
Reference:
https://docs.microsoft.com/en-us/azure/storage/common/storage-sas-overview
QUESTION 299
Hotspot Question
You need to create an Azure Storage account that meets the following requirements:
- Minimizes costs
- Supports hot, cool, and archive blob tiers
- Provides fault tolerance if a disaster affects the Azure region where
the account resides
How should you complete the command? To answer, select the appropriate options in the answer
area.
Answer:
Explanation:
Box 1: StorageV2
You may only tier your object storage data to hot, cool, or archive in Blob storage and General
Purpose v2 (GPv2) accounts. General Purpose v1 (GPv1) accounts do not support tiering.
General-purpose v2 accounts deliver the lowest per-gigabyte capacity prices for Azure Storage,
as well as industry-competitive transaction prices.
Box 2: Standard_GRS
Geo-redundant storage (GRS): Cross-regional replication to protect against region-wide
unavailability.
Incorrect Answers:
Locally-redundant storage (LRS): A simple, low-cost replication strategy. Data is replicated within
a single storage scale unit.
Read-access geo-redundant storage (RA-GRS): Cross-regional replication with read access to

the replica. RA-GRS provides read-only access to the data in the secondary location, in addition
to geo-replication across two regions, but is more expensive compared to GRS.
Reference:
https://docs.microsoft.com/en-us/azure/storage/common/storage-redundancy-grs
https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-storage-tiers
QUESTION 300
Hotspot Question
The status of VM1 is Running.
You assign an Azure policy as shown in the exhibit. (Click the Exhibit tab.)
You assign the policy by using the following parameters:
Microsoft.ClassicNetwork/virtualNetworks
Microsoft.Network/virtualNetworks
Microsoft.Compute/virtualMachines
Answer:
QUESTION 301
You have an on-premises server named Server1 that runs Windows Server 2016. Server1 has 2
TB of data.
In which order should you perform the actions? To answer, move all actions from the list of
Answer:
Explanation:
Step 1: Attach an external disk to Server1 and then run waimportexport.exe Determine data to be
imported, number of drives you need, destination blob location for your data in Azure storage.

Provide the return address and carrier account number for shipping the drives back to you. Ship
the disk drives to the shipping address provided during job creation.

Update the delivery tracking number in the import job details and submit the import job. The
drives are received and processed at the Azure data center. The drives are shipped using your
carrier account to the return address provided in the import job.
Reference:
QUESTION 302
Hotspot Question
You have an Azure subscription named Subscription1. Subscription1 contains the resources in
VNet1 is in RG1. VNet2 is in RG2. There is no connectivity between VNet1 and VNet2.
An administrator named Admin1 creates an Azure virtual machine named VM1 in RG1. VM1 uses
a disk named Disk1 and connects to VNet1. Admin1 then installs a custom application in VM1.
You need to move the custom application to VNet2. The solution must minimize administrative
effort.
area.
Answer:
Explanation:
Reference:
vnet-on-azure/
https://4sysops.com/archives/move-an-azure-vm-to-another-virtual-network-vnet/#migrate-an-
azure-vm-between-vnets
QUESTION 303
Hotspot Question
You have the App Service plans shown in the following table.
You need to identify which App Service plans can be used for the web apps.
What should you identify? To answer, select the appropriate options in the answer area.
Answer:
Explanation:
Box 1: ASP1 ASP3
Asp1, ASP3: ASP.NET Core apps can be hosted both on Windows or Linux.
Not ASP2: The region in which your app runs is the region of the App Service plan it's in.
Box 2: ASP1
ASP.NET apps can be hosted on Windows only.
Reference:
https://docs.microsoft.com/en-us/azure/app-service/quickstart-dotnetcore?pivots=platform-linux
https://docs.microsoft.com/en-us/azure/app-service/app-service-plan-manage#
QUESTION 304
Hotspot Question
You create a virtual machine scale set named Scale1. Scale1 is configured as shown in the
following exhibit.
Answer:
Explanation:
Box 1: 6 virtual machines
The Autoscale scale out rule increases the number of VMs by 2 if the CPU threshold is 80% or
higher. The initial instance count is 4 and rises to 6 when the 2 extra instances of VMs are added.
Box 2: 2 virtual machnes

The Autoscale scale in rule decreases the number of VMs by 4 if the CPU threshold is 30% or
lower. The initial instance count is 4 and thus cannot be reduced to 0 as the minimum instances
is set to 2. Instances are only added when the CPU threshold reaches 80%.
Reference:
QUESTION 305
Hotspot Question
You have an Azure Kubernetes Service (AKS) cluster named AKS1 and a computer named
Computer1 that runs Windows 10. Computer1 that has the Azure CLI installed.
You need to install the kubectl client on Computer1.
Answer:
Explanation:
To install kubectl locally, use the az aks install-cli command:
az aks install-cli
Reference:
https://docs.microsoft.com/en-us/azure/aks/kubernetes-walkthrough
QUESTION 306
You onboard 10 Azure virtual machines to Azure Automation State Configuration.
You need to use Azure Automation State Configuration to manage the ongoing consistency of the
virtual machine configurations.
Answer:
Explanation:
Step 1: Upload a configuration to Azure Automation State Configuration.
Import the configuration into the Automation account.
Step 2: Compile a configuration into a node configuration. A DSC configuration defining that state
must be compiled into one or more node configurations (MOF document), and placed on the
Automation DSC Pull Server.
Step 3: Assign the node configuration
Step 4: Check the compliance status of the node

Each time Azure Automation State Configuration performs a consistency check on a managed
node, the node sends a status report back to the pull server. You can view these reports on the
page for that node. On the blade for an individual report, you can see the following status
information for the corresponding consistency check:
The report status -- whether the node is "Compliant", the configuration "Failed", or the node is
"Not Compliant"
Reference:
https://docs.microsoft.com/en-us/azure/automation/automation-dsc-getting-started
QUESTION 307
Hotspot Question
You have an Azure subscription that contains the Azure virtual machines shown in the following
table.
You add inbound security rules to a network security group (NSG) named NSG1 as shown in the
following table.
You run Azure Network Watcher as shown in the following exhibit.
You run Network Watcher again as shown in the following exhibit.
Answer:
Explanation:
Box 1: No
It limits traffic to VM2, but not VM1 traffic.
Box 2: Yes
Yes, the destination is VM2.
Box 3: No
Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works
QUESTION 308
Hotspot Question
Answer:
Explanation:
Box 1: vNET6 only
Peering status to both VNet1 and Vnet2 are disconnected.
Box 2: delete peering1

Peering to Vnet1 is Enabled but disconnected. We need to update or re-create the remote
peering to get it back to Initiated state.
Reference:
https://blog.kloud.com.au/2018/10/19/address-space-maintenance-with-vnet-peering/
QUESTION 309
Hotspot Question
You have an Azure virtual machine named VM1 and a Recovery Services vault named Vault1.
You create a backup policy named Policy1 as shown in the exhibit. (Click the Exhibit tab.)
You configure the backup of VM1 to use Policy1 on Thursday, January 1.
You need to identify the number of available recovery points for VM1.
How many recovery points are available on January 8 and January 15? To answer, select the
Answer:
Explanation:
Box 1: 6
5 latest daily recovery points, which includes the weekly backup from the previous Sunday, plus
the monthly recovery point.
Box 2: 8
5 latest daily recovery points, plus two weekly backups, plus the monthly recovery point.
Reference:
https://social.technet.microsoft.com/Forums/en-US/854ab6ae-79aa-4bad-ac65-
471c4d422e94/daily-monthly-yearly-recovery-points-and-storage-
used?forum=windowsazureonlinebackup
QUESTION 310
Hotspot Question
contains the users shown in the following table.
You enable password reset for contoso.onmicrosoft.com as shown in the Password Reset exhibit.
(Click the Password Reset tab.)
You configure the authentication methods for password reset as shown in the Authentication
Methods exhibit. (Click the Authentication Methods tab.)
Answer:
Explanation:
Box 1: No
Two methods are required.
Box 2: No
Self-service password reset is only enabled for Group2, and User1 is not a member of Group2.
Box 3: Yes
As a User Administrator, User3 can add security questions to the reset process.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/authentication/quickstart-sspr
https://docs.microsoft.com/en-us/azure/active-directory/authentication/active-directory-
passwords-faq
QUESTION 311
You have an Azure Active Directory (Azure AD) tenant named contoso.onmicrosoft.com.
The User administrator role is assigned to a user named Admin1.
An external partner has a Microsoft account that uses the user1@outlook.com sign in.
Admin1 attempts to invite the external partner to sign in to the Azure AD tenant and receives the
following error message: "Unable to invite user user1@outlook.com - Generic authorization
exception."
You need to ensure that Admin1 can invite the external partner to sign in to the Azure AD tenant.
What should you do?
A. From the Users blade, modify the External collaboration settings.

B. From the Custom domain names blade, add a custom domain.
C. From the Organizational relationships blade, add an identity provider.
D. From the Roles and administrators blade, assign the Security administrator role to Admin1.
Answer: A
Explanation:
https://techcommunity.microsoft.com/t5/Azure-Active-Directory/Generic-authorization-exception-
inviting-Azure-AD-gests/td-p/274742
QUESTION 312
You have an Azure subscription that contains a user account named User1.
You need to ensure that User1 can assign a policy to the tenant root management group.
What should you do?
A. Assign the Owner role for the Azure Subscription to User1, and then modify the default conditional
access policies.
B. Assign the Owner role for the Azure subscription to User1, and then instruct User1 to configure
access management for Azure resources.
C. Assign the Global administrator role to User1, and then instruct User1 to configure access
management for Azure resources.
D. Create a new management group and delegate User1 as the owner of the new management
group.
Answer: B
Explanation:
The following chart shows the list of roles and the supported actions on management groups.
Note:
Each directory is given a single top-level management group called the "Root" management
group. This root management group is built into the hierarchy to have all management groups
and subscriptions fold up to it. This root management group allows for global policies and Azure
role assignments to be applied at the directory level. The Azure AD Global Administrator needs to
elevate themselves to the User Access Administrator role of this root group initially. After
elevating access, the administrator can assign any Azure role to other directory users or groups
to manage the hierarchy. As administrator, you can assign your own account as owner of the root
management group.
Reference:
QUESTION 313
correct solution.
You need to ensure that an Azure Active Directory (Azure AD) user named Admin1 is assigned
the required role to enable Traffic Analytics for an Azure subscription.
Solution: You assign the Network Contributor role at the subscription level to Admin1.
A. Yes
B. No
Answer: A
Explanation:
Your account must meet one of the following to enable traffic analytics:
Your account must have any one of the following Azure roles at the subscription scope: owner,
contributor, reader, or network contributor.
Reference:
https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics-faq
QUESTION 314
correct solution.
Solution: You assign the Owner role at the subscription level to Admin1.
A. Yes
B. No
Answer: A
Explanation:
Reference:
QUESTION 315
correct solution.
Solution: You assign the Reader role at the subscription level to Admin1.
A. Yes
B. No
Answer: A
Explanation:
Reference:
QUESTION 316
You have an Azure subscription that contains a user named User1.
You need to ensure that User1 can deploy virtual machines and manage virtual networks. The
solution must use the principle of least privilege.
Which role-based access control (RBAC) role should you assign to User1?
A. Owner
B. Virtual Machine Contributor
C. Contributor
D. Virtual Machine Administrator Login
Answer: B
Explanation:
Virtual Machine Contributor: Lets you manage virtual machines, but not access to them, and not
the virtual network or storage account they're connected to.
Incorrect Answers:
A: Owner: Grants full access to manage all resources, including the ability to assign roles in
Azure RBAC.
C: Contributor: Grants full access to manage all resources, but does not allow you to assign roles
in Azure RBAC.
D: Virtual Machine Administrator Login: View Virtual Machines in the portal and login as
administrator.
Reference:
QUESTION 317

B. a dataset CSV file
C. a JSON configuration file
E. a driveset CSV file
Answer: DE
Explanation:
D: Modify the dataset.csv file in the root folder where the tool resides. Depending on whether you
E: Modify the driveset.csv file in the root folder where the tool resides.
Reference:
https://docs.microsoft.com/en-us/azure/storage/common/storage-import-export-data-to-files
QUESTION 318
A. From the Recovery Service vault, delete the backup data.

B. Modify the disaster recovery properties of each virtual machine.
C. Modify the locks of each virtual machine.
D. From the Recovery Service vault, stop the backup of each backup item.
Answer: D
Explanation:
virtual machines.
Reference:
https://docs.microsoft.com/en-us/azure/backup/backup-azure-delete-vault
QUESTION 319
You have 5 TB of data that you need to transfer to Subscription1.
A. a virtual machine
B. an Azure Cosmos DB database
C. Azure File Storage
D. the Azure File Sync Storage Sync Service
Answer: C
Explanation:
Azure Import/Export service is used to securely import large amounts of data to Azure Blob
storage and Azure Files by shipping disk drives to an Azure datacenter.
The maximum size of an Azure Files Resource of a file share is 5 TB.
Reference:
QUESTION 320
correct solution.
deployment.
A. Yes
B. No
Answer: B
Explanation:
Reference:
QUESTION 321
correct solution.
Solution: You create a new network interface, and then you add the network interface to VM1.
A. Yes
B. No
Answer: B
Explanation:
Reference:
QUESTION 322
You have an Azure Active Directory (Azure AD) tenant named adatum.com that contains the
Adatum.com has the following configurations:
- Users may join devices to Azure AD is set to User1.

- Additional local administrators on Azure AD joined devices is set to
None.
You deploy Windows 10 to a computer named Computer1. User1 joins Computer1 to

adatum.com.
You need to identify the local Administrator group membership on Computer1.
Which users are members of the local Administrators group?
A. User1 only
B. User2 only
C. User1 and User2 only
D. User1, User2, and User3 only
E. User1, User2, User3, and User4
Answer: C
Explanation:
Users may join devices to Azure AD -This setting enables you to select the users who can
register their devices as Azure AD joined devices. The default is All.
Additional local administrators on Azure AD joined devices -You can select the users that are
granted local administrator rights on a device. Users added here are added to the Device
Administrators role in
Azure AD. Global administrators, here User2, in Azure AD and device owners are granted local
administrator rights by default.
Reference:
QUESTION 323
following table.
You create virtual machines in Subscription1 as shown in the following table.
You plan to use Vault1 for the backup of as many virtual machines as possible.
Which virtual machines can be backed up to Vault1?
A. VM1 only
B. VM3 and VMC only
C. VM1, VM2, VM3, VMA, VMB, and VMC
D. VM1, VM3, VMA, and VMC only
E. VM1 and VM3 only
Answer: D
Explanation:
To create a vault to protect virtual machines, the vault must be in the same region as the virtual
machines.
If you have virtual machines in several regions, create a Recovery Services vault in each region.
Reference:
https://docs.microsoft.com/bs-cyrl-ba/azure/backup/backup-create-rs-vault
QUESTION 324
You have an Azure Kubernetes Service (AKS) cluster named AKS1.
You need to configure cluster autoscaler for AKS1.
Which two tools should you use? Each correct answer presents a complete solution.
A. the kubectl command
B. the az aks command
C. the Set-AzVm cmdlet
D. the Azure portal
E. the Set-AzAks cmdlet
Answer: AB
Explanation:
A: The following example uses the kubectl autoscale command to autoscale the number of pods
in the azure-vote-front deployment. If average CPU utilization across all pods exceeds 50% of
their requested usage, the autoscaler increases the pods up to a maximum of 10 instances. A
minimum of 3 instances is then defined for the deployment:
kubectl autoscale deployment azure-vote-front --cpu-percent=50 --min=3 --max=10
B: Use the az aks update command to enable and configure the cluster autoscaler on the node
pool for the existing cluster.
Reference:
https://docs.microsoft.com/en-us/azure/aks/tutorial-kubernetes-scale
https://docs.microsoft.com/en-us/azure/aks/cluster-autoscaler
QUESTION 325
You create the following resources in an Azure subscription:
- An Azure Container Registry instance named Registry1

- An Azure Kubernetes Service (AKS) cluster named Cluster1
You create a container image named App1 on your administrative workstation.
You need to deploy App1 to Cluster1.
A. Run the docker push command.

B. Create an App Service plan.
C. Run the az acr build command.
D. Run the az aks create command.
Answer: C
Explanation:
You should sign in and push a container image to Container Registry.
Run the az acr build command to build and push the container image.
az acr build \
--image contoso-website \
--registry $ACR_NAME \
--file Dockerfile .
Reference:
https://docs.microsoft.com/en-us/learn/modules/aks-deploy-container-app/5-exercise-deploy-app
QUESTION 326
You need to configure a proximity placement group for VMSS1.
Which proximity placement groups should you use?
A. Proximity2 only
B. Proximity1, Proximity2, and Proximity3
C. Proximity1 only
D. Proximity1 and Proximity3 only
Answer: A
Explanation:
Resource Group location of VMSS1 is the RG2 location, which is West US.
Only Proximity2, which also in RG2, is location in West US Reference:
https://azure.microsoft.com/en-us/blog/introducing-proximity-placement-groups/
QUESTION 327
correct solution.
providers.
A. Yes
B. No
Answer: B
QUESTION 328
You create an Azure VM named VM1 that runs Windows Server 2019.
VM1 is configured as shown in the exhibit. (Click the Exhibit tab.)
You need to enable Desired State Configuration for VM1.
A. Connect to VM1.
B. Start VM1.
C. Capture a snapshot of VM1.
D. Configure a DNS name for VM1.
Answer: B
Explanation:
Status is Stopped (Deallocated).
The DSC extension for Windows requires that the target virtual machine is able to communicate
with Azure.
The VM needs to be started.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-machines/extensions/dsc-windows
QUESTION 329
machines.
A. Floating IP (direct server return) to Disabled

C. Protocol to UDP
D. Session persistence to Client IP
Answer: D
Explanation:
With Sticky Sessions when a client starts a session on one of your web servers, session stays on
that specific server. To configure An Azure Load-Balancer For Sticky Sessions set Session
persistence to Client IP or to Client IP and protocol.
Note:
Client IP and protocol specifies that successive requests from the same client IP address and
protocol combination will be handled by the same virtual machine.
Client IP specifies that successive requests from the same client IP address will be handled by
the same virtual machine.
Reference:
QUESTION 330
correct solution.
A virtual network that has a subnet named Subnet1

Two network security groups (NSGs) named NSG-VM1 and NSG-Subnet1
A virtual machine named VM1 that has the required Windows Server configurations to allow
Remote Desktop connections
NSG-Subnet1 has the default inbound security rules only.
NSG-VM1 has the default inbound security rules and the following custom inbound security rule:
Priority: 100
Source: Any
Source port range: *
Destination: *
Destination port range: 3389
Protocol: UDP
Action: Allow
VM1 has a public IP address and is connected to Subnet1. NSG-VM1 is associated to the
network interface of VM1. NSG-Subnet1 is associated to Subnet1.
You need to be able to establish Remote Desktop connections from the internet to VM1.
Solution: You add an inbound security rule to NSG-Subnet1 that allows connections from the Any
source to the *destination for port range 3389 and uses the TCP protocol. You remove NSG-VM1
from the network interface of VM1.
A. Yes
B. No
Answer: B
Explanation:
The default port for RDP is TCP port 3389. A rule to permit RDP traffic must be created
automatically when you create your VM.
Note on NSG-Subnet1: Azure routes network traffic between all subnets in a virtual network, by
default.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-machines/troubleshooting/troubleshoot-rdp-
connection
QUESTION 331
correct solution.

Priority: 100
Source: Any
Destination: *
Protocol: UDP
Action: Allow
Solution: You add an inbound security rule to NSG-Subnet1 that allows connections from the
internet source to the VirtualNetwork destination for port range 3389 and uses the UDP protocol.
A. Yes
B. No
Answer: B
Explanation:
default.
Reference:
connection
QUESTION 332
Note: This question is part of a series of questions that present the same scenario. Each question
in the series contains a unique solution that might meet the stated goals. Some question sets
might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.

Priority: 100
Source: Any
Destination: *
Protocol: UDP
Action: Allow
Solution: You add an inbound security rule to NSG-Subnet1 and NSG-VM1 that allows
connections from the internet source to the VirtualNetwork destination for port range 3389 and
uses the TCP protocol.
A. Yes
B. No
Answer: A
Explanation:
default.
Reference:
connection
QUESTION 333
You have an Azure subscription that contains a virtual network named VNET1. VNET1 contains
the subnets shown in the following table.
Each virtual machine uses a static IP address.
You need to create network security groups (NSGs) to meet following requirements:
- Allow web requests from the internet to VM3, VM4, VM5, and VM6.
- Allow all connections between VM1 and VM2.
- Allow Remote Desktop connections to VM1.
- Prevent all other network traffic to VNET1.
What is the minimum number of NSGs you should create?
A. 1
B. 3
C. 4
D. 12
Answer: C
Explanation:
Each network security group also contains default security rules.
Note: A network security group (NSG) contains a list of security rules that allow or deny network
traffic to resources connected to Azure Virtual Networks (VNet). NSGs can be associated to
subnets, individual VMs (classic), or individual network interfaces (NIC) attached to VMs
(Resource Manager).
Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/security-overview#default-security-rules
QUESTION 334
The Not allowed resource types Azure policy is assigned to RG1 and uses the following
parameters:
In RG1, you need to create a new virtual machine named VM2, and then connect VM2 to VNET1.
A. Remove Microsoft.Compute/virtualMachines from the policy.

B. Create an Azure Resource Manager template
C. Add a subnet to VNET1.
D. Remove Microsoft.Network/virtualNetworks from the policy.
Answer: A
Explanation:The Not allowed resource types Azure policy prohibits the deployment of specified
resource types. You specify an array of the resource types to block.
Virtual Networks and Virtual Machines are prohibited.
Reference:
https://docs.microsoft.com/en-us/azure/governance/policy/samples/not-allowed-resource-types
QUESTION 335
Your company has an Azure subscription named Subscription1.
The company also has two on-premises servers named Server1 and Server2 that run Windows
Server 2016. Server1 is configured as a DNS server that has a primary DNS zone named
adatum.com. Adatum.com contains 1,000 DNS records.
- The DNS Manager console

- Azure PowerShell
- Azure CLI 2.0
You need to move the adatum.com zone to an Azure DNS zone in Subscription1. The solution
must minimize administrative effort.
A. Azure CLI
B. Azure PowerShell
C. the Azure portal
Answer: B
Explanation:
Step 1: Installing the DNS migration script
Open an elevated PowerShell window (Administrative mode) and run following command install-
script PrivateDnsMigrationScript
Step 2: Running the script
Execute following command to run the script
PrivateDnsMigrationScript.ps1
Reference:
https://docs.microsoft.com/en-us/azure/dns/private-dns-migration-guide
QUESTION 336
You have a public load balancer that balances ports 80 and 443 across three virtual machines.
You need to direct all the Remote Desktop Protocol (RDP) connections to VM3 only.
A. an inbound NAT rule

B. a new public load balancer for VM3
C. a frontend IP configuration
D. a load balancing rule
Answer: A
Explanation:
https://docs.microsoft.com/en-us/azure/load-balancer/tutorial-load-balancer-port-forwarding-portal
https://pixelrobots.co.uk/2017/08/azure-load-balancer-for-rds/
QUESTION 337
VM1 and VM2 are deployed from the same template and host line-of-business applications.
You configure the network security group (NSG) shown in the exhibit. (Click the Exhibit tab.)
You need to prevent users of VM1 and VM2 from accessing websites on the Internet over TCP
port 80.
What should you do?
A. Disassociate the NSG from a network interface

B. Change the Port_80 inbound security rule.
C. Associate the NSG to Subnet1.
D. Change the DenyWebSites outbound security rule.
Answer: C
Explanation:
You can associate or dissociate a network security group from a network interface or subnet.
The NSG has the appropriate rule to block users from accessing the Internet. We just need to
Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/manage-network-security-group
QUESTION 338
You have two subscriptions named Subscription1 and Subscription2. Each subscription is
associated to a different Azure AD tenant.
Subscription1 contains a virtual network named VNet1. VNet1 contains an Azure virtual machine
named VM1 and has an IP address space of 10.0.0.0/16.
A. Move VM1 to Subscription2.

B. Move VNet1 to Subscription2.
C. Modify the IP address space of VNet2.
D. Provision virtual network gateways.
Answer: D
Explanation:The virtual networks can be in the same or different regions, and from the same or
different subscriptions.
When connecting VNets from different subscriptions, the subscriptions do not need to be
associated with the same Active Directory tenant.
Configuring a VNet-to-VNet connection is a good way to easily connect VNets. Connecting a
virtual network to another virtual network using the VNet-to-VNet connection type (VNet2VNet) is
similar to creating a Site-to-Site IPsec connection to an on-premises location. Both connectivity
types use a VPN gateway to provide a secure tunnel using IPsec/IKE, and both function the same
way when communicating.
The local network gateway for each VNet treats the other VNet as a local site. This lets you
specify additional address space for the local network gateway in order to route traffic.
Reference:
https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-vnet-vnet-resource-
manager-portal
QUESTION 339
You plan to create an Azure virtual machine named VM1 that will be configured as shown in the
following exhibit.
The planned disk configurations for VM1 are shown in the following exhibit.
You need to ensure that VM1 can be created in an Availability Zone.
Which two settings should you modify? Each correct answer presents part of the solution.
A. Use managed disks

B. OS disk type
C. Availability options
D. Size
E. Image
Answer: AB
Explanation:
A: Your VMs should use managed disks if you want to move them to an Availability Zone by using
Site Recovery.
B: When you create a VM for an Availability Zone, Under Settings > High availability, select one
of the numbered zones from the Availability zone dropdown.
Reference:
https://docs.microsoft.com/en-us/azure/site-recovery/move-azure-vms-avset-azone
https://docs.microsoft.com/en-us/azure/virtual-machines/windows/create-portal-availability-zone
QUESTION 340
You have an existing Azure subscription that contains 10 virtual machines.
You need to monitor the latency between your on-premises network and the virtual machines.
A. Service Map
C. Network Performance Monitor
D. Effective routes
Answer: C
Explanation:
Network Performance Monitor is a cloud-based hybrid network monitoring solution that helps you
monitor network performance between various points in your network infrastructure. It also helps
you monitor network connectivity to service and application endpoints and monitor the
performance of Azure ExpressRoute.
You can monitor network connectivity across cloud deployments and on-premises locations,
multiple data centers, and branch offices and mission-critical multitier applications or
microservices. With Performance Monitor, you can detect network issues before users complain.
Reference:
https://docs.microsoft.com/en-us/azure/azure-monitor/insights/network-performance-monitor
QUESTION 341
Overview
maintains.
- File servers
- A SQL database
- A web front end
only.
Requirements
Planned Changes
migration project.
backups.
tier.
temporary.
Azure.
virtualmachines.
User Requirements
Azure subscription.
Azure subscription.
Hotspot Question
requirements.
area.
Answer:
QUESTION 342
Hotspot Question
Which three settings should you configure? To answer, select the appropriate settings in the
answer area.
Answer:
Explanation:
https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/app-based-mfa
QUESTION 343
Hotspot Question
You have an Azure Active Directory (Azure AD) tenant named adatum.com. Adatum.com
contains the groups in the following table.
To which groups do User1 and User2 belong? To answer, select the appropriate options in the
answer area.
Answer:
Explanation:
Box 1: Group 1 only
First rule applies
Box 2: Group1 and Group2 only

Both membership rules apply.
Reference:
QUESTION 344
Hotspot Question
You have a hybrid deployment of Azure Active Directory (Azure AD) that contains the users
shown in the following table.
You need to modify the JobTitle and UsageLocation attributes for the users.
For which users can you modify the attributes from Azure AD? To answer, select the appropriate
Answer:
Explanation:
Box 1: User1 and User3 only
You must use Windows Server Active Directory to update the identity, contact info, or job info for
users whose source of authority is Windows Server Active Directory.
Box 2: User1, User2, and User3
Reference:
profile-azure-portal
QUESTION 345
Hotspot Question
following table.
In storage1, you create a blob container named blob1 and a file share named share1.
Which resources can be backed up to Vault1 and Vault2? To answer, select the appropriate
Answer:
Explanation:
Box 1: VM1 only
VM1 is in the same region as Vault1.
File1 is not in the same region as Vautl1.
SQL is not in the same region as Vault1.
Blobs cannot be backup up to service vaults.
Note: To create a vault to protect virtual machines, the vault must be in the same region as the
virtual machines.
Box 2: Share1 only.

Storage1 is in the same region (West USA) as Vault2. Share1 is in Storage1.
Note: After you select Backup, the Backup pane opens and prompts you to select a storage
account from a list of discovered supported storage accounts. They're either associated with this
vault or present in the same region as the vault, but not yet associated to any Recovery Services
vault.
Reference:
https://docs.microsoft.com/en-us/azure/backup/backup-afs
QUESTION 346
Hotspot Question
You create the Azure Storage account shown in the following exhibit.
Answer:
Explanation:
Box 1: 3
Locally Redundant Storage (LRS) provides highly durable and available storage within a single
location (sub region). We maintain an equivalent of 3 copies (replicas) of your data within the
primary location as described in our SOSP paper; this ensures that we can recover from common
failures (disk, node, rack) without impacting your storage account's availability and durability.
Box 2: Access tier

Change the access tier from Hot to Cool.
Note: Azure storage offers different access tiers, which allow you to store blob object data in the
most cost-effective manner. The available access tiers include:
Hot -Optimized for storing data that is accessed frequently. Cool -Optimized for storing data that
is infrequently accessed and stored for at least 30 days. Archive -Optimized for storing data that
is rarely accessed and stored for at least 180 days with flexible latency requirements (on the
order of hours).
Reference:
https://azure.microsoft.com/en-us/blog/data-series-introducing-locally-redundant-storage-for-
windows-azure-storage/
QUESTION 347
Hotspot Question
You have Azure subscriptions named Subscription1 and Subscription2.
Subscription1 has following resource groups:
RG1 includes a web app named App1 in the West Europe location.
Subscription2 contains the following resource groups:
Answer:
Explanation:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/move-
limitations/app-service-move-limitations
QUESTION 348
Hotspot Question
You have an Azure subscription named Subscription1 that contains the following resource group:
- Name: RG1
- Region: West US
- Tag: "tag1": "value1"
You assign an Azure policy named Policy1 to Subscription1 by using the following configurations:
- Exclusions: None
- Policy definition: Append a tag and its value to resources
- Assignment name: Policy1
- Parameters:
- Tag name: Tag2
- Tag value: Value2
After Policy1 is assigned, you create a storage account that has the following configuration:
- Name: storage1
- Location: West US
- Resource group: RG1
- Tags: "tag3": "value3"
You need to identify which tags are assigned to each resource.
Answer:
Explanation:
Box 1: "tag1": "value1" only
Box 2: "tag2": "value2" and "tag3": "value2" only
Tags applied to the resource group are not inherited by the resources in that resource group.
Reference:
QUESTION 349
Hotspot Question
In Subscription1, you create an alert rule named Alert1.
The Alert1 action group is configured as shown in the following exhibit.
Alert1 alert criteria triggered every minute.
Answer:
Explanation:
Box 1: 60
Box 2: 12
No more than 1 SMS every 5 minutes can be send, which equals 12 per hour.
Note: Rate limiting is a suspension of notifications that occurs when too many are sent to a
particular phone number, email address or device. Rate limiting ensures that alerts are
manageable and actionable.

SMS: No more than 1 SMS every 5 minutes.
Voice: No more than 1 Voice call every 5 minutes.
Email: No more than 100 emails in an hour.
Other actions are not rate limited.
Reference:
https://docs.microsoft.com/en-us/azure/azure-monitor/platform/alerts-rate-limiting
QUESTION 350
Hotspot Question
Answer:
Explanation:
Box 1: add an address space
Your IaaS virtual machines (VMs) and PaaS role instances in a virtual network automatically
receive a private IP address from a range that you specify, based on the address space of the
subnet they are connected to. We need to add the 192.168.1.0/24 address space.
Box 2: add a network interface

The 10.2.1.0/24 network exists. We need to add a network interface.
Reference:
https://docs.microsoft.com/en-us/office365/enterprise/designing-networking-for-microsoft-azure-
iaas
QUESTION 351
Hotspot Question
You have an Azure subscription named Subscription1 that contains the virtual networks in the
following table.
In Subscription1, you create a load balancer that has the following configurations:
Name: LB1
SKU: Basic
Type: Internal
Subnet: Subnet12
Virtual network: VNET1
Answer:
Explanation:
QUESTION 352
Hotspot Question
You have an Azure virtual machine that runs Windows Server 2019 and has the following
configurations:
Name: VM1
Location: West US
Connected to: VNET1
Private IP address: 10.1.0.4
Public IP addresses: 52.186.85.63
DNS suffix in Windows Server: Adatum.com
You create the Azure DNS zones shown in the following table.
You need to identify which DNS zones you can link to VNET1 and the DNS zones to which VM1
can automatically register.
Which zones should you identify? To answer, select the appropriate options in the answer area.
Answer:
Explanation:
QUESTION 353
You have an on-premises network that you plan to connect to Azure by using a site-so-site VPN.
In Azure, you have an Azure virtual network named VNet1 that uses an address space of
10.0.0.0/16 VNet1 contains a subnet named Subnet1 that uses an address space of 10.0.0.0/24.
You need to create a site-to-site VPN to Azure.
NOTE: More than one order of answer choice is correct. You will receive credit for any of the
Answer:
QUESTION 354
Hotspot Question
VMSS1 is set to VM (virtual machines) orchestration mode.
You need to deploy a new Azure virtual machine named VM1, and then add VM1 to VMSS1.
Which resource group and location should you use to deploy VM1? To answer, select the
Answer:
Explanation:
Box 1: RG1, RG2, or RG3
The resource group stores metadata about the resources. When you specify a location for the
resource group, you're specifying where that metadata is stored.
Box 2: West US only
Note: Virtual machine scale sets will support 2 distinct orchestration modes:
ScaleSetVM - Virtual machine instances added to the scale set are based on the scale set
configuration model. The virtual machine instance lifecycle -creation, update, deletion -is
managed by the scale set.
VM (virtual machines) - Virtual machines created outside of the scale set can be explicitly added
to the scaleset.
Reference:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/overview
QUESTION 355
Hotspot Question
Peering for VNET2 is configured as shown in the following exhibit.
How can packets be routed between the virtual networks? To answer, select the appropriate
Answer:
Explanation:
Box 1. VNET2 and VNET3
Box 2: VNET1
Gateway transit is disabled.
Reference:
QUESTION 356
You have an Azure subscription that contains a virtual network named VNet1. VNet 1 has two
subnets named Subnet1 and Subnet2. VNet1 is in the West Europe Azure region.
The subscription contains the virtual machines in the following table.
You need to deploy an application gateway named AppGW1 to VNet1.
A. Add a service endpoint.

B. Add a virtual network.
C. Move VM3 to Subnet1.
D. Stop VM1 and VM2.
Answer: C
Explanation:
Tested this movement (inside assigned NIC in section IPConfiguration, there is an option to
change subnet, which restarted VM). After restart VM had new private IP from different subnet.
I also tried to stop VM in subnet, where only this VM was assigned. Then I tried to create new
AppGtw to this subnet and portal did not give me the option, selected subnet was not possible to
use. Even if VM was stopped, it still had its privateID (public was released) what was probably the
reason, why this subnet is not usable for AppGtw.
QUESTION 357
adatum.com.
From the Azure Active Directory blade, you assign the Conditional Access Administrator role to a
user named Admin1.
You need to ensure that Admin1 has just-in-time access as a conditional access administrator.
What should you do next?
A. Enable Azure AD Multi-Factor Authentication (MFA).

B. Set Admin1 as Eligible for the Privileged Role Administrator role.
C. Set Admin1 as Eligible for the Conditional Access Administrator role.
D. Enable Azure AD Identity Protection.
Answer: C
Explanation:
https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/baseline-protection
QUESTION 358
You are the global administrator for an Azure Directory (Azure AD) tenant named adatum.com.
What should you do?
A. Create a single sign-in risk policy in Azure AD Identity Protection.

B. Enable Azure AD Privileged Identity Management.
C. Create and configure the Identity Hub.
D. Configure a security policy in Azure Security Center.
Answer: A
Explanation:
With Azure Active Directory Identity Protection, you can:
require users to register for multi-factor authentication
handle risky sign-ins and compromised users
References:
https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/flows
QUESTION 359
You have an Azure subscription named Subscription1 that contains an Azure virtual machine
named VM1.
VM1 is in a resource group named RG1.
VM1 runs services that will be used to deploy resources to RG1.
You need to ensure that a service running on VM1 can manage the resources in RG1 by using
the identity of VM1.
A. From the Azure portal, modify the Access control (IAM) settings of VM1.
B. From the Azure portal, modify the Policies settings of RG1.
C. From the Azure portal, modify the value of the Managed Service Identity option for VM1.
D. From the Azure portal, modify the Access control (IAM) settings of RG1.
Answer: C
Explanation:
A managed identity from Azure Active Directory allows your app to easily access other AAD-
protected resources such as Azure Key Vault. The identity is managed by the Azure platform and
does not require you to provision or rotate any secrets.
User assigned managed identities can be used on Virtual Machines and Virtual Machine Scale
Sets.
References:
https://docs.microsoft.com/en-us/azure/app-service/app-service-managed-service-identity
QUESTION 360
You are configuring Azure Active Directory (AD) Privileged Identity Management.
You need to provide a user named Admin1 with read access to a resource group named RG1 for
only one month. The user role must be assigned immediately.
What should you do?
A. Assign an active role.

B. Assign an eligible role.
C. Assign a permanently active role.
D. Create a custom role and a conditional access policy.
Answer: A
Explanation:
https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-
configure
QUESTION 361
You have an Azure Active Directory (Azure AD) tenant named Tenant1 and an Azure subscription
named Subscription1.
You enable Azure AD Privileged Identity Management.
You need to secure the members of the Lab Creator role. The solution must ensure that the lab
creators request access when they create labs.
A. From Azure AD Privileged Identity Management, edit the role settings for Lab Creator.
B. From Subscription1, edit the members of the Lab Creator role.
C. From Azure AD Identity Protection, create a user risk policy.
D. From Azure AD Privileged Identity Management, discover the Azure resources of Subscription1.
Answer: A
Explanation:
As a Privileged Role Administrator you can:
Enable approval for specific roles
Specify approver users and/or groups to approve requests
View request and approval history for all privileged roles
References:
configure
QUESTION 362
You create an Azure subscription that is associated to a basic Azure Active Directory (Azure AD)
tenant.
You need to receive an email notification when any user activates an administrative role.
What should you do?
A. Purchase Azure AD Premium P2 and configure Azure AD Privileged Identity Management.

B. Purchase Enterprise Mobility + Security E3 and configure conditional access policies.
C. Purchase Enterprise Mobility + Security E5 and create a custom alert rule in Azure Security Center.
D. Purchase Azure AD Premium P1 and enable Azure AD Identity Protection.
Answer: A
Explanation:
When key events occur in Azure AD Privileged Identity Management (PIM), email notifications
are sent.
For example, PIM sends emails for the following events:
When a privileged role activation is pending approval
When a privileged role activation request is completed
When a privileged role is activated
When a privileged role is assigned
When Azure AD PIM is enabled
References:
email-notifications
QUESTION 363
You have an existing Azure AD conditional access policy named Policy1. Policy1 enforces the
use of Azure AD-joined devices when members of the Global Administrators group authenticate
to Azure AD from untrusted locations.
You need to ensure that members of the Global Administrators group will also be forced to use
multi-factor authentication when authenticating from untrusted locations.
What should you do?
A. From the multi-factor authentication page, modify the service settings.

B. From the multi-factor authentication page, modify the user settings.
C. From the Azure portal, modify grant control of Policy1.
D. From the Azure portal, modify session control of Policy1.
Answer: C
Explanation:
There are two types of controls:
Grant controls - To gate access
Session controls - To restrict access to a session
Grant controls oversee whether a user can complete authentication and reach the resource that
they're attempting to sign-in to. If you have multiple controls selected, you can configure whether
all of them are required when your policy is processed. The current implementation of Azure
Active Directory enables you to set the following grant control requirements:
References:
https://blog.lumen21.com/2017/12/15/conditional-access-in-azure-active-directory/
QUESTION 364
You enable multi-factor authentication for all users.
Some users report that the email applications on their mobile device cannot connect to their
Microsoft Exchange Online mailbox. The users can access Exchange Online by using a web
browser and from Microsoft Outlook 2016 on their computer.
You need to ensure that the users can use the email applications on their mobile device.
What should you instruct the users to do?
A. Enable self-service password reset.
B. Create an app password.
C. Reset the Azure Active Directory (Azure AD) password.
D. Reinstall the Microsoft Authenticator app.
Answer: B
QUESTION 365
You have an Azure subscription named Subscription1 and two Azure Active Directory (Azure AD)
tenants named Tenant1 and Tenant2.
Subscription1 is associated to Tenant1. Multi-factor authentication (MFA) is enabled for all the
users in Tenant1.
You need to enable MFA for the users in Tenant2. The solution must maintain MFA for Tenant1.
A. Transfer the administration of Subscription1 to a global administrator of Tenant2

B. Configure the MFA Server setting in Tenant1.
C. Create and link a subscription to Tenant2.
D. Change the directory for Subscription1.
Answer: C
QUESTION 366
Your VMware vSphere on-premises infrastructure hosts 600 virtual machines (VMs).
Your company is planning to move all of these VMs to Azure. You are asked to provide
information about
the resources that will be needed in Azure to host all of the VMs.
All VMs hosted in your on-premise infrastructure are based on Windows Server 2012 R2 or
newer and RedHat Enterprise Linux 7.0 or newer.
You conduct the initial migration assessment and get a message that some virtual machines are
conditionally ready for Azure.
You need to find the cause of this message.
What are two reasons why are you might get this message on some VMs? Each correct answer
presents part of the solution.
A. The vCenter user does not have enough permissions on affected VMs.
B. The operating system is configured as Windows Server 2003 in vCenter Server.
C. The operating system is configured as Others in vCenter Server.
D. The VMs are configured with the BIOS boot type.
E. The VMs are configured with the UEFI boot type.
Answer: BE
QUESTION 367
You have five Windows Server 2008 R2 physical servers. The servers satisfy all requirements for
failover protection using Azure Site Recovery (ASR).
ASR is correctly configured and active.
You need to ensure that only 10 minutes of data is lost in the event of an incident by using the
minimum amount of effort.
Which PowerShell cmdlet should you run?
A. Edit-AzureRmSiteRecoveryPolicy
B. Edit-AzureRmSiteRecoveryRecoveryPlan
C. New-AzureRmSiteRecoveryPolicy
D. Get-AzureRmSiteRecoveryRecoveryPlan
Answer: A
QUESTION 368
You manage an on-premises infrastructure based on VMware vSphere 6.0 with 250 virtual
machines (VMs). You are evaluating the possibility of moving those VMs to Azure.
You decide to use the Azure Migrate service to help you with the assessment of your on-
premises infrastructure.
You configure the default data collection level for your VMware vCenter server.
After performing the initial assessment, you find that there is some missing information in the
assessment.
You need to make needed configurations so Azure Migrate service can collect all of the available
information.
What should you do?
A. Configure the data collector level in VMware vCenter to level 3.

B. Configure the collector VM with a user account with administrative privileges.
C. Configure the data collector level in VMware vCenter to level 2.
D. Configure the collector VM with a user account with read-only privileges.
Answer: A
QUESTION 369
Hotspot Question
You create an Azure web app named WebApp1.

WebApp1 has the autoscale settings shown in the following exhibit.
The scale out and scale in rules are configured to have a duration of 10 minutes and a cool down
time of five minutes.
Answer:
Explanation:
https://docs.microsoft.com/en-us/azure/monitoring-and-diagnostics/insights-autoscale-best-
practices
QUESTION 370
You have an Azure subscription that contains an Azure Service Bus named Bus1.
Your company plans to deploy two Azure web apps named App1 and App2. The web apps will
create messages that have the following requirements:
- Each message created by App1 must be consumed by only a single

consumer
- Each message created by App2 will be consumed by multiple consumers.
Which resource should you create for each web app? To answer, drag the appropriate resources
to the correct web apps. Each resource may be used once, more than once, or not at all. You
may need to drag the split bar between panes or scroll to view content.
Answer:
Explanation:
App1: A service Bus queue
In Queues each message is processed by a single consumer.
App2: A Service Bus topic
In contrast to queues, in which each message is processed by a single consumer, topics and
subscriptions provide a one-to-many form of communication, in a publish/subscribe pattern.
References:
https://www.codit.eu/blog/exploring-azure-event-grid-are-service-bus-topic-dead/
QUESTION 371
You are developing an Azure web app named WebApp1. WebApp1 uses an Azure App Service
plan named Plan1 that uses the B1 pricing tier.
You need to configure WebApp1 to add additional instances of the app when CPU usage
exceeds 70 percent for 10 minutes.
Answer:
Explanation:
Box 1: From the Scale out (App Service Plan) settings blade, change the pricing tier The B1
pricing tier only allows for 1 core. We must choose another pricing tier.
Box 2: From the Scale out (App Service Plan) settings blade, enable autoscale
1. Log in to the Azure portal at http://portal.azure.com

2. Navigate to the App Service you would like to autoscale.
3. Select Scale out (App Service plan) from the menu
4. Click on Enable autoscale. This activates the editor for scaling rules.
Box 3: From the Scale mode to Scale based on metric, add a rule, and set the instance limits.
Click on Add a rule. This shows a form where you can create a rule and specify details of the
scaling.
References:
https://blogs.msdn.microsoft.com/hsirtl/2017/07/03/autoscaling-azure-web-apps/
QUESTION 372
Hotspot Question
You have an Azure web app named WebApp1 that runs in an Azure App Service plan named
ASP1. ASP1 is based on the D1 pricing tier.
You need to ensure that WebApp1 can be accessed only from computers on your on-premises
network.
The solution must minimize costs.
What should you configure? To answer, select the appropriate options in the answer area.
Answer:
Explanation:
Box 1: B1
B1 (Basic) would minimize cost compared P1v2 (premium) and S1 (standard).
Box 2: Cross Origin Resource Sharing (CORS)
Once you set the CORS rules for the service, then a properly authenticated request made against
the service from a different domain will be evaluated to determine whether it is allowed according
to the rules you have specified.
Note: CORS (Cross Origin Resource Sharing) is an HTTP feature that enables a web application
running under one domain to access resources in another domain. In order to reduce the
possibility of cross-site scripting attacks, all modern web browsers implement a security restriction
known as same-origin policy. This prevents a web page from calling APIs in a different domain.
CORS provides a secure way to allow one origin (the origin domain) to call APIs in another origin.
References:
https://docs.microsoft.com/en-us/azure/cdn/cdn-cors
QUESTION 373
Hotspot Question
You have an Azure web app named WebApp1.
You need to provide developers with a copy of WebApp1 that they can modify without affecting
the production WebApp1. When the developers finish testing their changes, you must be able to
switch the current line version of WebApp1 to the new version.
Which command should you run prepare the environment? To answer, select the appropriate
Answer:
Explanation:
Box 1: New-AzureRmWebAppSlot
The New-AzureRmWebAppSlot cmdlet creates an Azure Web App Slot in a given a resource
group that uses the specified App Service plan and data center.
Box 2: -SourceWebApp
References:
https://docs.microsoft.com/en-us/powershell/module/azurerm.websites/new-azurermwebappslot
QUESTION 374
- a virtual network named VNet1

- a replication policy named ReplPolicy1
- a Recovery Services vault named Vault1
- an Azure Storage account named Storage1
You have an Amazon Web Services (AWS) EC2 virtual machine named VM1 that runs Windows
Server 2016.
You need to migrate VM1 to VNet1 by using Azure Site Recovery.
Answer:
Explanation:
Step 1: Deploy an EC2 virtual machine as a configuration server Prepare source include:
1. Use an EC2 instance that's running Windows Server 2012 R2 to create a configuration server
and register it with your recovery vault.
2. Configure the proxy on the EC2 instance VM you're using as the configuration server so that it
can access the service URLs.
Step 2: Install Azure Site Recovery Unified Setup.
Download Microsoft Azure Site Recovery Unified Setup. You can download it to your local
machine and then copy it to the VM you're using as the configuration server.
Step 3: Enable replication for VM1.
Enable replication for each VM that you want to migrate. When replication is enabled, Site
Recovery automatically installs the Mobility service.
References:
https://docs.microsoft.com/en-us/azure/site-recovery/migrate-tutorial-aws-azure
QUESTION 375
You create an Azure Migrate project named TestMig in a resource group named test-migration.
You need to discover which on-premises virtual machines to assess for migration.
Answer:
QUESTION 376
Hotspot Question
Your company has offices in New York and Los Angeles.
You have an Azure subscription that contains an Azure virtual network named VNet1. Each office
has a site-to-site VPN connection to VNet1.
Each network uses the address spaces shown in the following table.
You need to ensure that all Internet-bound traffic from VNet1 is routed through the New York
office.
Answer:
Explanation:
Box 1: Set-AzureRmVirtualNetworkGatewayDefaultSite
The Set-AzureRmVirtualNetworkGatewayDefaultSite cmdlet assigns a forced tunneling default
site to a virtual network gateway. Forced tunneling provides a way for you to redirect Internet-
bound traffic from Azure virtual machines to your on-premises network; this enables you to
inspect and audit traffic before releasing it. Forced tunneling is carried out by using a virtual
private network (VPN) tunnel; this tunnel requires a default site, a local gateway where all the
Azure Internet-bound traffic is redirected. Set- AzureRmVirtualNetworkGatewayDefaultSite
provides a way to change the default site assigned to a gateway.
Incorrect Answers:
Not: New-AzureRmVirtualNetworkGatewayConnection
This command creates the Site-to-Site VPN connection between the virtual network gateway and
the on- prem VPN device. We already have Site-to-Site VPN connections.
Box 2: 192.168.0.0/20
Specify the VNET1 address.
Incorrect Answers:
Not: New-AzureRmVirtualNetworkGatewayConnection
This command creates the Site-to-Site VPN connection between the virtual network gateway and
the on- prem VPN device. We already have Site-to-Site VPN connections.
Box 2: 192.168.0.0/20
Specify the VNET1 address.
References:
https://docs.microsoft.com/en-us/powershell/module/azurerm.network/set-
azurermvirtualnetworkgatewaydefaultsite
QUESTION 377
Hotspot Question
using a site-to-site VPN. VMet1 contains one subnet named Subnet1.
Subnet1 is associated to a network security group (NSG) named NSG1. Subnet1 contains a
basic internal load balancer named ILB1. ILB1 has three Azure virtual machines in the backend
pool.
Answer:
Explanation:
Box 2: ILB1
References:
QUESTION 378
Hotspot Question
You have an Azure subscription named Subscription1 that contains the resources in the following
table.
VM1 and VM2 run the websites in the following table.
AppGW1 has the backend pools in the following table.
DNS resolves site1.contoso.com, site2.contoso.com, and site3.contoso.com to the IP address of
AppGW1.
AppGW1 has the listeners in the following table.
AppGW1 has the rules in the following table.
Answer:
Explanation:
Vm1 is in Pool1. Rule2 applies to Pool1, Listener 2, and site2.contoso.com
QUESTION 379
Hotspot Question
You have an on-premises data center and an Azure subscription. The data center contains two
VPN devices. The subscription contains an Azure virtual network named VNet1. VNet1 contains a
gateway subnet.
You need to create a site-to-site VPN. The solution must ensure that is a single instance of an
Azure VPN gateway fails, or a single on-premises VPN device fails, the failure will not cause an
interruption that is longer than two minutes.
What is the minimum number of public IP addresses, virtual network gateways, and local network
gateways required in Azure? To answer, select the appropriate options in the answer area.
Answer:
Explanation:
Box 1: 4
Two public IP addresses in the on-premises data center, and two public IP addresses in the
VNET. The most reliable option is to combine the active-active gateways on both your network
and Azure, as shown in the diagram below.
Box 2: 2
Every Azure VPN gateway consists of two instances in an active-standby configuration. For any
planned maintenance or unplanned disruption that happens to the active instance, the standby
instance would take over (failover) automatically, and resume the S2S VPN or VNet-to-VNet
connections.
Box 3: 2
Dual-redundancy: active-active VPN gateways for both Azure and on-premises networks
References:
https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-highlyavailable
QUESTION 380
You have Azure virtual machines that run Windows Server 2019 and are configured as shown in
the following table:
contoso.com.
For contoso.com, you create a virtual network link named link1 as shown in the exhibit. (Click the
Exhibit tab.)
Exhibit
You discover that VM1 can resolve names in contoso.com but cannot resolve names in
adatum.com. VM1 can resolve other hosts on the internet.
You need to ensure that VM1 can resolve host names in adatum.com.
What should you do?
A. Modify the Access control (IAM) settings for link1.

B. Configure the name servers for adatum.com at the domain registrar.
C. Update the DNS suffix on VM1 to be adatum.com.
D. Create an SRV record in the contoso.com zone.
Answer: B
Explanation:
Adatum.com is a public DNS zone. The Internet top level domain DNS servers need to know
which DNS servers to direct DNS queries for adatum.com to. You configure this by configuring
the name servers for adatum.com at the domain registrar.
QUESTION 381
Hotspot Question
You plan to create a new Azure Active Directory (Azure AD) role.
You need to ensure that the new role can view all the resources in the Azure subscription and
issue support requests to Microsoft. The solution must use the principle of least privilege.
How should you complete the JSON definition? To answer, select the appropriate options in the
answer area.
Answer:
Explanation:
Box 1: "*/read",
*/read lets you view everything, but not make any changes.
Box 2: " Microsoft.Support/*"

The action Microsoft.Support/* enables creating and management of support tickets.
References:
https://docs.microsoft.com/en-us/azure/role-based-access-control/tutorial-custom-role-powershell
QUESTION 382
Hotspot Question
You have an Azure Active Directory (Azure AD) tenant that contains three global administrators
named Admin1, Admin2, and Admin3.
The tenant is associated to an Azure subscription. Access control for the subscription is
configured as shown in the Access control exhibit. (Click the Exhibit tab.)
You sign in to the Azure portal as Admin1 and configure the tenant as shown in the Tenant
exhibit. (Click the Exhibit tab.)
Answer:
QUESTION 383
You create an Azure subscription named Subscription1 and an associated Azure Active Directory
(Azure AD) tenant named Tenant1. Tenant1 contains the users in the following table.
You need to add an Azure AD Privileged Identity Management application to Tenant1.
Which account can you use?
A. Admin3@contoso.onmicrosoft.com
B. Admin1@contoso.onmicrosoft.com
C. Admin2@contoso.onmicrosoft.com
D. ContosoAdmin1@hotmail.com
Answer: B
Explanation:
getting-started
QUESTION 384
Hotspot Question
You have an Azure web app named App1 that has two deployment slots named Production and
Staging. Each slot has the unique settings shown in the following table.
You perform a slot swap.
What are the configurations of the Production slot after the swap? To answer, select the
NOTE: Each correction is worth one point.
Answer:
Explanation:
Swapping the slots means the destination slot website URL will run source slot code with
destination slot settings.
QUESTION 385
Hotspot Question
In Subscription1, you create an Azure web app named WebApp1. WebApp1 will access an
external service that requires certificate authentication.
You plan to require the use of HTTPS to access WebApp1.
You need to upload certificates to WebApp1.
In which formats should you upload the certificate? To answer, select the appropriate options in
the answer area.
Answer:
Explanation:
A PFX file contains the public key file (SSL Certificate) and its unique private key file. This is
required for HTTPS access. The web app will distribute the public key (in a CER file) to clients
that connect to the web app.
The CER file is an SSL Certificate which has the public key of the external service. The external
service will have the private key associated with the public key contained in the CER file.
QUESTION 386
Hotspot Question
You are creating an Azure load balancer.
You need to add an IPv6 load balancing rule to the load balancer.
How should you complete the Azure PowerShell script? To answer, select the appropriate options
in the answer area.
Answer:
QUESTION 387
Hotspot Question
You have an Azure virtual machine named VM1 that connects to a virtual network named VNet1.
VM1 has the following configurations:
Subnet: 10.0.0.0/24
Network security group (NSG): None
Public IP address: 40.90.219.6 (dynamic)
You deploy a standard, Internet-facing load balancer named slb1.
You need to configure slb1 to allow connectivity to VM1.
Which changes should you apply to VM1 as you configure slb1? To answer, select the
Answer:
QUESTION 388
Hotspot Question
You enable Azure Active Directory (AD) Privileged Identity Management.
From Azure AD Privileged Identity Management, you configure the Global Administrator role for
the Azure Active Directory (Azure AD) tenant as shown in the Role settings exhibit. (Click the
Exhibit tab.)
From Azure AD Privileged Identity Management, you configure the global administrators as
shown in the Members exhibit. (Click the Exhibit tab.)
User2 activates the Global Administrator role on July 16, 2018, at 10:00, as shown in the
Activation exhibit.
(Click the Exhibit tab.)
Answer:
QUESTION 389
You have an on-premises network that contains a Hyper-V host named Host1. Host1 runs
Windows Server 2016 and hosts 10 virtual machines that run Windows Server 2016.
You plan to replicate the virtual machines to Azure by using Azure Site Recovery.
You create a Recovery Services vault named ASR1 and a Hyper-V site named Site1.
You need to add Host1 to ASR1.
What should you do?
A. Download the installation file for the Azure Site Recovery Provider.
Download the vault registration key.
Install the Azure Site Recovery Provider on Host1 and register the server.
B. Download the installation file for the Azure Site Recovery Provider.
Download the storage account key.
Install the Azure Site Recovery Provider on Host1 and register the server.
C. Download the installation file for the Azure Site Recovery Provider.
Download the vault registration key.
Install the Azure Site Recovery Provider on each virtual machine and register the virtual machines.
D. Download the installation file for the Azure Site Recovery Provider.
Download the storage account key.
Install the Azure Site Recovery Provider on each virtual machine and register the virtual machines.
Answer: A
Explanation:
Download the Vault registration key. You need this when you install the Provider. The key is valid
for five days after you generate it.
Install the Provider on each VMM server. You don't need to explicitly install anything on Hyper-V
hosts.
Incorrect Answers:
B, D: Use the Vault Registration Key, not the storage account key.
References:
https://docs.microsoft.com/en-us/azure/site-recovery/migrate-tutorial-on-premises-azure
QUESTION 390
You plan to move services from your on-premises network to Azure.
You identify several virtual machines that you believe can be hosted in Azure. The virtual
machines are shown in the following table.
Which two virtual machines can you access by using Azure migrate? Each correct answer
presents a complete solution.
A. Sea-CA01
B. Hou-NW01
C. NYC-FS01
D. Sea-DC01
E. BOS-DB01
Answer: BE
Explanation:
The VMware VMs must be managed by vCenter Server (version 5.5, 6.0, or 6.5).
References:
https://docs.microsoft.com/en-us/azure/migrate/migrate-overview
QUESTION 391
You hire a temporary vendor. The vendor uses a Microsoft account that has a sign-in of
user1@outlook.com.
You need to ensure that the vendor can authenticate to the tenant by using user1@outlook.com.
What should you do?
A. From the Azure portal, add a custom domain name, create a new Azure AD user, and then
specify user1@outlook.com as the username.
B. From Azure Cloud Shell, run the New-AzureADUser cmdlet and specify the
C. From the Azure portal, add a new guest user, and then specify user1@outlook.com as the email
address.
D. From Windows PowerShell, run the New-AzureADUser cmdlet and specify the
Answer: C
Explanation:
We should use Azure portal, add a new guest user, and then specify user1@outlook.com as the
email address.
The New-AzureADUser cmdlet creates a new user not a new guest user. The New-
AzureADMSInvitation cmdlet is used to invite a new external user to your directory, but the cmdlet
uses the -InvitedUserEmailAddress parameter instead of -UserPrincipalName.
QUESTION 392
You set the multi-factor authentication status for a user named admin1@contoso.com to Enabled.
Admin1 accesses the Azure portal by using a web browser.
Which additional security verifications can Admin1 use when accessing the Azure portal?
A. a phone call, a text message that contains a verification code, and a notification or a verification
code sent from the Microsoft Authenticator app
B. an app password, a text message that contains a verification code, and a notification sent from
the Microsoft Authenticator app
C. an app password, a text message that contains a verification code, and a verification code sent
from the Microsoft Authenticator app
D. a phone call, an email message that contains a verification code, and a text message that
contains an app password
Answer: A
QUESTION 393
The company's security policy states that all personal devices and corporate-owned devices must
be registered or joined to Azure AD.
A remote user named User1 is unable to join a personal device to Azure AD from a home
network. You verify that other users can join their devices to Azure AD.
What should you do?
A. From the Device settings blade, modify the Users may join devices to Azure AD setting.
D. Assign the User administrator role to User1.
Answer: B
Explanation:
The Maximum number of devices setting enables you to select the maximum number of devices
that a user can have in Azure AD. If a user reaches this quota, they will not be able to add
additional devices until one or more of the existing devices are removed.
Incorrect Answers:
A: The Users may join devices to Azure AD setting enables you to select the users who can join
References:
QUESTION 394
following error message: "Unable to invite user user1@outlook.com ?Generic authorization
exception."
What should you do?
A. From the Roles and administrators blade, assign the Security administrator role to Admin1.
B. From the Organizational relationships blade, add an identity provider.
C. From the Custom domain names blade, add a custom domain.
D. From the Users blade, modify the External collaboration settings.
Answer: D
Explanation:
QUESTION 395
Your company has an Azure Active Directory (Azure AD) tenant named contoso.com that is
configured for hybrid coexistence with the on-premises Active Directory domain. The tenant
Whenever possible, you need to enable Azure Multi-Factor Authentication (MFA) for the users in
contoso.com.
Which users should you enable for Azure MFA?
A. User1 only
B. User1, User2, and User3 only
D. User1, User2, User3, and User4
E. User2 only
Answer: D
QUESTION 396
All administrators must enter a verification code to access the Azure portal.
You need to ensure that the administrators can access the Azure portal only from your on-
premises network.
A. an Azure AD Identity Protection user risk policy.

B. the multi-factor authentication service settings.
C. the default for all the roles in Azure AD Privileged Identity Management
D. an Azure AD Identity Protection sign-in risk policy
Answer: B
QUESTION 397
Hotspot Question
You plan to use Azure Resource Manager templates to deploy 50 Azure virtual machines that will
be part of the same availability set.
You need to ensure that as many virtual machines as possible are available if the fabric fails or
during servicing.
How should you configure the template? To answer, select the appropriate options in the answer
area.
Answer:
Explanation:
Use two fault domains.
2 or 3 is max value, depending on which region you are in.
Use 20 for platformUpdateDomainCount
Increasing the update domain (platformUpdateDomainCount) helps with capacity and availability
planning when the platform reboots nodes. A higher number for the pool (20 is max) means that
fewer of their nodes in any given availability set would be rebooted at once.
References:
https://www.itprotoday.com/microsoft-azure/check-if-azure-region-supports-2-or-3-fault-domains-
managed-disks
https://github.com/Azure/acs-engine/issues/1030
QUESTION 398
You have an Azure subscription named Subscription1 that contains an Azure Log Analytics
workspace named Workspace1.
You need to view the error events from a table named Event.
A. Get-Event Event | where ($_.EventType -eq "error")

B. Get-Event Event | where ($_.EventType == "error")
C. search in (Event) * | where EventType –eq "error"
D. search in (Event) "error"
E. select *from Event where EventType == "error"
F. Event | where EventType is "error"
Answer: D
Explanation:
To search a term in a specific table, add in (table-name) just after the search operator
References:
QUESTION 399
correct solution.
for a host named www that has an IP address of 131.107.1.10.
address.
Solution: You modify the name servers at the domain registrar.
A. Yes
B. No
Answer: A
Explanation:
Delegate the domain
Now that the DNS zone is created and you have the name servers, you need to update the
parent domain with the Azure DNS name servers. Each registrar has its own DNS management
tools to change the name server records for a domain.
QUESTION 400
You have an Azure subscription named Subscription1 that contains the resource groups shown in
In RG1, you create a virtual machine named VM1 in the East Asia location.
You plan to create a virtual network named VNET1.
You need to create VNET1, and then connect VM1 to VNET1.
What are two possible ways to achieve this goal? Each correct answer presents a complete
solution.
A. Create VNET1 in RG2, and then set East Asia as the location.
B. Create VNET1 in a new resource group in the West US location, and then set West US as the
location.
C. Create VNET1 in RG1, and then set East US as the location.
D. Create VNET1 in RG2, and then set East US as the location.
E. Create VNET1 in RG1, and then set East Asia as the location.
Answer: AE
QUESTION 401
You have an Azure virtual machine named VM1.
Azure collects events from VM1.
You are creating an alert rule in Azure Monitor to notify an administrator when an error is logged
in the System event log of VM1.
You need to specify which resource type to monitor.
What should you specify?
A. metric alert
B. Azure Log Analytics workspace
C. virtual machine
D. virtual machine extension
Answer: D
Explanation:
Azure Monitor can collect data directly from your Azure virtual machines into a Log Analytics
workspace for detailed analysis and correlation. Installing the Log Analytics VM extension for
Windows and Linux allows Azure Monitor to collect data from your Azure VMs.
Incorrect Answers:
B: Azure Log Analytics workspace is used for on-premises computers monitored by System
Center Operations Manager.
Reference:
https://docs.microsoft.com/en-us/azure/azure-monitor/learn/quick-collect-azurevm
QUESTION 402
The network interface for VM1 is configured as shown in the exhibit. (Click the Exhibit tab.)
You deploy a web server on VM1, and then create a secure website that is accessible by using
the HTTPS protocol. VM1 is used as a web server only.
You need to ensure that users can connect to the website from the internet.
What should you do?
A. Create a new inbound rule that allows TCP protocol 443 and configure the protocol to have a
priority of 501.
B. For Rule5, change the Action to Allow and change the priority to 401.
C. Delete Rule1.
D. Modify the protocol of Rule4.
Answer: B
Explanation:
Rule 2 is blocking HTTPS access (port 443) and has a priority of 500.
Changing Rule 5 (ports 50-5000) and giving it a lower priority number will allow access on port
443.
Note: Rules are processed in priority order, with lower numbers processed before higher
numbers, because lower numbers have higher priority. Once traffic matches a rule, processing
stops.
Incorrect Answers:
A: Rule 2 is blocking HTTPS access (port 443) and has a priority of 500. Creating a rule for the
same protocol (443) with a higher priority number will not help.
C: Rule 1 blocks access to port 80, which is used for HTTP, not HTTPS.
D: Rule 2 is blocking HTTPS access (port 443). Changing Rule 4 allows access on UDP but is a
higher priority number than Rule. Changing the protocol on Rule 4 to TCP will not help if we don't
also change the priority to a lower number.
References:
QUESTION 403
Hotspot Question
You have an Azure subscription that contains several virtual machines and an Azure Log
Analytics workspace named Workspace1.
You create a log search query as shown in the following exhibit.
Answer:
Explanation:
Box 1: 14 days
Two weeks will be covered.
Note: Startofweek returns the start of the week containing the date, shifted by an offset, if
provided.
Start of the week is considered to be a Sunday.
Endofweek returns the end of the week containing the date, shifted by an offset, if provided.
Last day of the week is considered to be a Saturday.
Box 2:
The render operator renders results in as graphical output. Timechart is a Line graph, where the
first column is x-axis, and should be datetime. Other columns are y-axes. In this case the Y axis
has avg (CounterValue) Values.
Reference:
https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/log-query-overview
https://docs-analytics-
eus.azurewebsites.net/queryLanguage/query_language_renderoperator.html
QUESTION 404
You have an Azure subscription that contains a resource group named TestRG.
You use TestRG to validate an Azure deployment.
TestRG contains the following resources:
You need to delete TestRG.
A. Modify the backup configurations of VM1 and modify the resource lock type of VNET1.
B. Turn off VM1 and delete all data in Vault1.
C. Remove the resource lock from VNET1 and delete all data in Vault1.
D. Turn off VM1 and remove the resource lock from VNET1.
Answer: D
Explanation:
When you want to delete the resource, you first need to remove the lock.
References:
https://docs.microsoft.com/sv-se/azure/azure-resource-manager/management/lock-resources
docs.microsoft.com/en-us/azure/azure-monitor/platform/itsmc-overview
QUESTION 405
- 100 Azure virtual machines

- 20 Azure SQL databases
- 50 Azure file shares
You need to create a daily backup of all the resources by using Azure Backup.
What is the minimum number of backup policies that you must create?
A. 1
B. 2
C. 3
D. 150
E. 170
Answer: C
Explanation:
There is a limit of 100 VMs that can be associated to the same backup policy from portal. We
recommend that for more than 100 VMs, create multiple backup policies with same schedule or
different schedule.
One policy for VMS, one for SQL databases, and one for the file shares.
References:
https://docs.microsoft.com/en-us/azure/backup/backup-azure-vm-backup-faq
QUESTION 406
This question is part of a series of questions that present the same scenario. Each
correct solution.
following table.
VM1 connects to a virtual network named VNET2 by using a network interface named NIC1.
You need to create a new network interface named NIC2 for VM1.
Solution: You create NIC2 in RG1 and Central US.
A. Yes
B. No
Answer: B
Explanation:
The virtual machine you attach a network interface to and the virtual network you connect it to
must exist in the same location, here West US, also referred to as a region.
References:
https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface
QUESTION 407
correct solution.
following table.
A. Yes
B. No
Answer: B
Explanation:
References:
QUESTION 408
You use Azure Backup to create a backup of VM1 named Backup1.
After creating Backup1, you perform the following changes to VM1:
Modify the size of VM1.
- Copy a file named Budget.xls to a folder named Data.

- Reset the password for the built-in administrator account.
- Add a data disk to VM1.
An administrator uses the Replace existing option to restore VM1 from Backup1.
You need to ensure that all the changes to VM1 are restored.
Which change should you perform again?
A. Modify the size of VM1.

B. Add a data disk.
C. Reset the password for the built-in administrator account.
D. Copy Budget.xls to Data.
Answer: D
Explanation:
https://docs.microsoft.com/en-us/azure/backup/backup-azure-arm-restore-vms#replace-existing-
disks
QUESTION 409
You need to create a network interface named NIC1.
In which location can you create NIC1?
A. East US and North Europe only.

B. East US and West Europe only.
C. East US, West Europe, and North Europe.
D. East US only.
Answer: D
Explanation:
A virtual network is required when you create a NIC. Select the virtual network for the network
interface.
You can only assign a network interface to a virtual network that exists in the same subscription
and location as the network interface. Once a network interface is created, you cannot change
the virtual network it is assigned to. The virtual machine you add the network interface to must
also exist in the same location and subscription as the network interface.
References:
QUESTION 410
correct solution.
following table.
Solution: You create NIC2 in RG1 and West US.
A. Yes
B. No
Answer: A
Explanation:
References:
QUESTION 411
correct solution.
following table.
A. Yes
B. No
Answer: A
Explanation:
References:
QUESTION 412
correct solution.
- A virtual network that has a subnet named Subnet1

- Two network security groups (NSGs) named NSG-VM1 and NSG-Subnet1
- A virtual machine named VM1 that has the required Windows Server
configurations to allow Remote Desktop connections
Priority: 100
Source: Any
Destination: *
Protocol: UDP
Action: Allow
VM1 connects to Subnet1. NSG1-VM1 is associated to the network interface of VM1. NSG-
Subnet1 is associated to Subnet1.
Solution: You modify the custom rule for NSG-VM1 to use the internet as a source and TCP as a
protocol.
A. Yes
B. No
Answer: A
Explanation:
default.
References:
connection
QUESTION 413
VM1 and VM2 run a website that is configured as shown in the following table.
LB1 is configured to balance requests to VM1 and VM2.
You configure a health probe as shown in the exhibit. (Click the Exhibit tab.)
You need to ensure that the health probe functions correctly.
What should you do?
A. On LB1, change the Unhealthy threshold to 65536.

B. On LB1, change the port to 8080.
C. On VM1 and VM2, create a file named Probe1.htm in the C:\intepub\wwwroot\Temp folder.
D. On VM1 and VM2, create a file named Probe1.htm in the C:\intepub\wwwroot\SiteA\Temp folder.
Answer: D
Explanation:
https://docs.microsoft.com/en-us/azure/load-balancer/tutorial-load-balancer-standard-internal-
portal
QUESTION 414
You have an Azure Active Directory (Azure AD) tenant named contoso.com. Multi-factor
authentication (MFA) is enabled for all users.
You need to provide users with the ability to bypass MFA for 10 days on devices to which they
have successfully signed in by using MFA.
What should you do?
A. From the multi-factor authentication page, configure the users' settings.

B. From Azure AD, create a conditional access policy.
C. From the multi-factor authentication page, configure the service settings.
D. From the MFA blade in Azure AD, configure the MFA Server settings.
Answer: C
Explanation:
Enable remember Multi-Factor Authentication
1. Sign in to the Azure portal.
2. On the left, select Azure Active Directory > Users.
3. Select Multi-Factor Authentication.
4. Under Multi-Factor Authentication, select service settings.
5. On the Service Settings page, manage remember multi-factor authentication, select the Allow
users to remember multi-factor authentication on devices they trust option.
6. Set the number of days to allow trusted devices to bypass two-step verification. The default is
14 days.
7. Select Save.
References:
QUESTION 415
You have a hybrid infrastructure that contains an Azure Active Directory (Azure AD) tenant
named contoso.onmicrosoft.com. The tenant contains the users shown in the following table.
You plan to share a cloud resource to the All Users group.
You need to ensure that User1, User2, User3, and User4 can connect successfully to the cloud
resource.
A. Create a user account of the member type for User4.
B. Create a user account of the member type for User3.
C. Modify the Directory-wide Groups settings.
D. Modify the External collaboration settings.
Answer: C
Explanation:
Ensure that "Enable an 'All Users' group in the directory" policy is set to "Yes" in your Azure
Active Directory (AD) settings in order to enable the "All Users" group for centralized access
administration. This group represents the entire collection of the Active Directory users, including
guests and external users, that you can use to make the access permissions easier to manage
within your directory.
Incorrect Answers:
A, B: User3 and User4 are guests already.
Note: By default, all users and guests in your directory can invite guests even if they're not
assigned to an admin role. External collaboration settings let you turn guest invitations on or off
for different types of users in your organization. You can also delegate invitations to individual
users by assigning roles that allow them to invite guests.
References:
https://www.cloudconformity.com/knowledge-base/azure/ActiveDirectory/enable-all-users-
group.html
QUESTION 416
You have a Microsoft 365 subscription and a hybrid deployment of Azure Active Directory (Azure
AD).
User identities and password hashes are synced.
You have a user account named User1.
From Active Directory, you select the User must change password at next logon account option
for User1.
What will occur if User1 attempts to sigh in to myapps.microsoft.com?
A. User1 will be prompted for a password change.

B. User1 will sign in by using the old password.
C. User1 will be prevented from signing in.
Answer: C
Explanation:
Troubleshoot password synchronization
Some users can't sign in to Office 365, Azure, or Microsoft Intune In this scenario, passwords of
most users appear to be syncing. However, there are some users whose passwords appear not
to sync. The following are scenarios in which a user cannot sign in to a Microsoft cloud service
such as Office 365, Azure, or Intune. They include information about how to troubleshoot each
scenario.
Scenario 1: The "User must change password at next logon" check box is selected for the user's
account To resolve this issue, follow these steps:
1. Do one of the following:
In the user account properties in Active Directory Users and Computers, clear the User must
change password at next logon check box.
Have the user change their on-premises user account password.
2. Wait a few minutes for the change to sync between the on-premises Active Directory Domain
Services (AD DS) and Azure AD.
References:
https://support.microsoft.com/en-us/help/2855271/how-to-troubleshoot-password-
synchronization-when-using-an-azure-ad-sy
QUESTION 417
correct solution.
You have an Azure Active Directory (Azure AD) tenant named contoso.com that is synced to an
Active Directory domain.
The tenant contains the users shown in the following table.
The users have the attributes shown in the following table.
You need to ensure that you can enable Azure Multi-Factor Authentication (MFA) for all users.
Solution: You create a new user account in Azure AD for User3.
A. Yes
B. No
Answer: A
Explanation:
User3 requires a user account in Azure AD.
Note: Your Azure AD password is considered an authentication method. It is the one method that
cannot be disabled.
References:
https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-
methods
QUESTION 418
correct solution.
Solution: You add an office phone number for User2.
A. Yes
B. No
Answer: B
Explanation:
cannot be disabled.
References:
methods
QUESTION 419
correct solution.
Solution: You add a mobile phone number for User2 and User4.
A. Yes
B. No
Answer: B
Explanation:
cannot be disabled.
References:
methods
QUESTION 420
You have an Azure subscription. All users are enabled for multi-factor authentication (MFA).
You need to ensure that the users can lock out their own account if they receive an unsolicited
MFA request from Azure.
Which MFA settings should you configure?
A. Block/unblock users
B. Providers
C. Notifications
D. Fraud alert
Answer: D
Explanation:
Configure the fraud alert feature so that your users can report fraudulent attempts to access their
resources. Users can report fraud attempts by using the mobile app or through their phone.
Configuration options include:
Block user when fraud is reported: If a user reports fraud, their account is blocked for 90 days or
until an administrator unblocks their account. An administrator can review sign-ins by using the
sign-in report, and take appropriate action to prevent future fraud. An administrator can then
unblock the user's account.
References:
https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-
mfasettings#fraud-alert
QUESTION 421
Your on-premises network contains an Active Directory domain named adatum.com that is
synced to Azure Active Directory (Azure AD). Password writeback is disabled.
In adatum.com, you create the users shown in the following table.
Which users must sign in from a computer joined to adatum.com?
A. User2 only
B. User1 and User3 only
C. User1, User2, and User3
D. User2 and User3 only
E. User1 only
Answer: E
Explanation:
Password writeback is a feature enabled with Azure AD Connect that allows password changes
in the cloud to be written back to an existing on-premises directory in real time.
References:
https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-writeback
Question #1
Your company has serval departments. Each department has a number of virtual machines (VMs).
The company has an Azure subscription that contains a resource group named RG1.
All VMs are located in RG1.
You want to associate each VM with its respective department.
What should you do?
U
R
A. Create Azure Management Groups for each department.
B. Create a resource group for each department.
C. Assign tags to the virtual machines. U

G
D. Modify the settings of the virtual machines.
SS
Correct Answer: C
Reference:
PA
AM
Question #2 Topic 1
Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result.
EX
Establish if the solution satisfies the requirements.

Your company has an Azure Active Directory (Azure AD) subscription.
You want to implement an Azure AD conditional access policy.
The policy must be configured to require members of the Global Administrators group to use Multi-Factor Authentication and an Azure AD-joined
device when they connect to Azure AD from untrusted locations.
Solution: You access the multi-factor authentication page to alter the user settings.
Does the solution meet the goal?
A. Yes
B. No
Correct Answer: B
Question #3 Topic 1
Solution: You access the Azure portal to alter the session control of the Azure AD conditional access policy.
A. Yes
B. No
Correct Answer: B
Question #4 Topic 1
U
R
U
G
SS

Solution: You access the Azure portal to alter the grant control of the Azure AD conditional access policy.
PA
A. Yes
B. No
AM
Correct Answer: A
EX
Question #5 Topic 1
You are planning to deploy an Ubuntu Server virtual machine to your company‫ג‬€™s Azure subscription.
You are required to implement a custom deployment that includes adding a particular trusted root certification authority (CA).
Which of the following should you use to create the virtual machine?
A. The New-AzureRmVm cmdlet.
B. The New-AzVM cmdlet.
C. The Create-AzVM cmdlet.
D. The az vm create command.
Correct Answer: C
Once Cloud-init.txt has been created, you can deploy the VM with az vm create cmdlet, using the --custom-data parameter to provide the full
path to the cloud- init.txt file.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-machines/linux/tutorial-automate-vm-deployment
Question #6 Topic 1
Your company makes use of Multi-Factor Authentication for when users are not in the office. The Per Authentication option has been configured
as the usage model.
After the acquisition of a smaller business and the addition of the new staff to Azure Active Directory (Azure AD) obtains a different company and
adding the new employees to Azure Active Directory (Azure AD), you are informed that these employees should also make use of Multi-Factor
Authentication.
To achieve this, the Per Enabled User setting must be set for the usage model.
Solution: You reconfigure the existing usage model via the Azure portal.
A. Yes
B. No
Correct Answer: B
Since it is not possible to change the usage model of an existing provider as it is right now, you have to create a new one and reactivate your
existing server with activation credentials from the new provider.
U
Reference:
https://365lab.net/2015/04/11/switch-usage-model-in-azure-multi-factor-authentication-server/
R
Question #7 U Topic 1
G
SS
Your company‫ג‬€™s Azure solution makes use of Multi-Factor Authentication for when users are not in the office. The Per Authentication option
PA
has been configured as the usage model.

AM
Authentication.
Solution: You reconfigure the existing usage model via the Azure CLI.
EX
A. Yes
B. No
Correct Answer: B
Reference:
Question #8 Topic 1
Your company‫ג‬€™s Azure solution makes use of Multi-Factor Authentication for when users are not in the office. The Per Authentication option
has been configured as the usage model.
Authentication.
Solution: You create a new Multi-Factor Authentication provider with a backup from the existing Multi-Factor Authentication provider data.
A. Yes
B. No
Correct Answer: A
U
Reference:
R
U
G
Question #9 Topic 1
SS
PA
Your company has an Azure Active Directory (Azure AD) tenant named weyland.com that is configured for hybrid coexistence with the on-premises
Active
Directory domain.
AM
You have a server named DirSync1 that is configured as a DirSync server.

You create a new user account in the on-premise Active Directory. You now need to replicate the user information to Azure AD immediately.
Solution: You run the Start-ADSyncSyncCycle -PolicyType Initial PowerShell cmdlet.
EX
A. Yes
B. No
Correct Answer: A
Reference:
https://blog.kloud.com.au/2016/03/08/azure-ad-connect-manual-sync-cycle-with-powershell-start-adsyncsynccycle/
Question #10 Topic 1
Active
Directory domain.
Solution: You use Active Directory Sites and Services to force replication of the Global Catalog on a domain controller.
A. Yes
B. No
Correct Answer: B
U
R
U
G
Active
Directory domain.
SS

Solution: You restart the NetLogon service on a domain controller.
PA
A. Yes
AM
B. No
Correct Answer: B
EX
Your company has a Microsoft Azure subscription.

The company has datacenters in Los Angeles and New York.
You are configuring the two datacenters as geo-clustered sites for site resiliency.
You need to recommend an Azure storage redundancy option.
You have the following data storage requirements:
✑ Data must be stored on multiple nodes.
✑ Data must be stored on nodes in separate geographic locations.
✑ Data can be read from the secondary location as well as from the primary location.
Which of the following Azure stored redundancy options should you recommend?
A. Geo-redundant storage
B. Read-only geo-redundant storage
C. Zone-redundant storage
D. Locally redundant storage
Correct Answer: B
RA-GRS allows you to have higher read availability for your storage account by providing ‫ג‬€read only‫ג‬€ access to the data replicated to the
U
secondary location. Once you enable this feature, the secondary location may be used to achieve higher availability in the event the data is not
R
available in the primary region. This is an
‫ג‬€opt-in‫ג‬€ feature which requires the storage account be geo-replicated.
Reference:
U
G
SS
PA

AM
Your company has an azure subscription that includes a storage account, a resource group, a blob container and a file share.
A colleague named Jon Ross makes use of a solitary Azure Resource Manager (ARM) template to deploy a virtual machine and an additional
EX
Azure Storage account.

You want to review the ARM template that was used by Jon Ross.
Solution: You access the Virtual Machine blade.
A. Yes
B. No
Correct Answer: B
You should use the Resource Group blade
Reference:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-manager-export-template
Solution: You access the Resource Group blade.
A. Yes
B. No
Correct Answer: A
To view a template from deployment history:
1. Go to the resource group for your new resource group. Notice that the portal shows the result of the last deployment. Select this link.
U
R
U
G
2. You see a history of deployments for the group. In your case, the portal probably lists only one deployment. Select this deployment.
SS
PA
AM
3. The portal displays a summary of the deployment. The summary includes the status of the deployment and its operations and the values that
you provided for parameters. To see the template that you used for the deployment, select View template.
EX
Reference:
Solution: You access the Container blade.
A. Yes
B. No
Correct Answer: B
You should use the Resource Group blade
Reference:
U
R
U
G
Your company has three virtual machines (VMs) that are included in an availability set.
You try to resize one of the VMs, which returns an allocation failure message.
SS
It is imperative that the VM is resized.

Which of the following actions should you take?
PA
A. You should only stop one of the VMs.
B. You should stop two of the VMs.

AM
C. You should stop all three VMs.
D. You should remove the necessary VM from the availability set.

EX
Correct Answer: C
If the VM you wish to resize is part of an availability set, then you must stop all VMs in the availability set before changing the size of any VM in
the availability set.
The reason all VMs in the availability set must be stopped before performing the resize operation to a size that requires different hardware is
that all running VMs in the availability set must be using the same physical hardware cluster. Therefore, if a change of physical hardware cluster
is required to change the VM size then all VMs must be first stopped and then restarted one-by-one to a different physical hardware clusters.
Reference:
https://azure.microsoft.com/es-es/blog/resize-virtual-machines/
You have an Azure virtual machine (VM) that has a single data disk. You have been tasked with attaching this data disk to another Azure VM.
You need to make sure that your strategy allows for the virtual machines to be offiine for the least amount of time possible.
Which of the following is the action you should take FIRST?
A. Stop the VM that includes the data disk.
B. Stop the VM that the data disk must be attached to.
C. Detach the data disk.
D. Delete the VM that includes the data disk.
Correct Answer: A
Reference:
https://docs.microsoft.com/en-us/azure/virtual-machines/windows/detach-disk https://docs.microsoft.com/en-us/azure/lab-services/devtest-
lab-attach-detach-data-disk
U
R
Your company has an Azure subscription.
You need to deploy a number of Azure virtual machines (VMs) using Azure Resource Manager (ARM) templates. You have been informed that the
VMs will be included in a single availability set.
U
G
You are required to make sure that the ARM template you configure allows for as many VMs as possible to remain accessible in the event of fabric
failure or maintenance.
SS
Which of the following is the value that you should configure for the platformFaultDomainCount property?
A. 10
PA
B. 30
C. Min Value
AM
D. Max Value
Correct Answer: D
EX
The number of fault domains for managed availability sets varies by region - either two or three per region.
Reference:
Your company has an Azure subscription.

You need to deploy a number of Azure virtual machines (VMs) using Azure Resource Manager (ARM) templates. You have been informed that the
VMs will be included in a single availability set.
You are required to make sure that the ARM template you configure allows for as many VMs as possible to remain accessible in the event of fabric
failure or maintenance.
Which of the following is the value that you should configure for the platformUpdateDomainCount property?
A. 10
B. 20
C. 30
D. 40
Correct Answer: D
Each virtual machine in your availability set is assigned an update domain and a fault domain by the underlying Azure platform. For a given
availability set, five non-user-configurable update domains are assigned by default (Resource Manager deployments can then be increased to
provide up to 20 update domains) to indicate groups of virtual machines and underlying physical hardware that can be rebooted at the same
time.
U
Reference:
R
U
G
SS
PA
AM
EX
DRAG DROP -
You have downloaded an Azure Resource Manager (ARM) template to deploy numerous virtual machines (VMs). The ARM template is based on a
current VM, but must be adapted to reference an administrative password.
You need to make sure that the password cannot be stored in plain text.
You are preparing to create the necessary components to achieve your goal.
Which of the following should you create to achieve your goal? Answer by dragging the correct option from the list to the answer area.
Select and Place:
U
R
U
G
SS
PA
AM
EX
Correct Answer:
U
R
U
You can use a template that allows you to deploy a simple Windows VM by retrieving the password that is stored in a Key Vault. Therefore, the
G
password is never put in plain text in the template parameter file.
SS
PA
Your company has an Azure Active Directory (Azure AD) tenant that is configured for hybrid coexistence with the on-premises Active Directory
AM
domain.
The on-premise virtual environment consists of virtual machines (VMs) running on Windows Server 2012 R2 Hyper-V host servers.
You have created some PowerShell scripts to automate the configuration of newly created VMs. You plan to create several new VMs.
EX
You need a solution that ensures the scripts are run on the new VMs.
Which of the following is the best solution?
A. Configure a SetupComplete.cmd batch file in the %windir%\setup\scripts directory.
B. Configure a Group Policy Object (GPO) to run the scripts as logon scripts.
C. Configure a Group Policy Object (GPO) to run the scripts as startup scripts.
D. Place the scripts in a new virtual hard disk (VHD).
Correct Answer: A
After you deploy a Virtual Machine you typically need to make some changes before it‫ג‬€™s ready to use. This is something you can do manually
or you could use
Remote PowerShell to automate the configuration of your VM after deployment for example.
But now there‫ג‬€™s a third alternative available allowing you customize your VM: the CustomScriptextension.
This CustomScript extension is executed by the VM Agent and it‫ג‬€™s very straightforward: you specify which files it needs to download from
your storage account and which file it needs to execute. You can even specify arguments that need to be passed to the script. The only
requirement is that you execute a .ps1 file.
Reference:
https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/add-a-custom-script-to-windows-setup
https://azure.microsoft.com/en-us/blog/automating-vm-customization-tasks-using-custom-script-extension/
Your company has an Azure Active Directory (Azure AD) tenant that is configured for hybrid coexistence with the on-premises Active Directory
domain.
You plan to deploy several new virtual machines (VMs) in Azure. The VMs will have the same operating system and custom software
requirements.
You configure a reference VM in the on-premise virtual environment. You then generalize the VM to create an image.
You need to upload the image to Azure to ensure that it is available for selection when you create the new Azure VMs.
Which PowerShell cmdlets should you use?
A. Add-AzVM
B. Add-AzVhd
C. Add-AzImage
D. Add-AzImageDataDisk
Correct Answer: B
The Add-AzVhd cmdlet uploads on-premises virtual hard disks, in .vhd file format, to a blob storage account as fixed virtual hard disks.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-machines/windows/upload-generalized-managed
U
R
U
G
SS
PA
AM
EX
DRAG DROP -
Your company has an Azure subscription that includes a number of Azure virtual machines (VMs), which are all part of the same virtual network.
Your company also has an on-premises Hyper-V server that hosts a VM, named VM1, which must be replicated to Azure.
Which of the following objects that must be created to achieve this goal? Answer by dragging the correct option from the list to the answer area.
Select and Place:
U
R
U
G
SS
PA
AM
EX
Correct Answer:
Your company‫ג‬€™s Azure subscription includes two Azure networks named VirtualNetworkA and VirtualNetworkB.
VirtualNetworkA includes a VPN gateway that is configured to make use of static routing. Also, a site-to-site VPN connection exists between your
company‫ג‬€™s on- premises network and VirtualNetworkA.
You have configured a point-to-site VPN connection to VirtualNetworkA from a workstation running Windows 10. After configuring virtual network
peering between
VirtualNetworkA and VirtualNetworkB, you confirm that you are able to access VirtualNetworkB from the company‫ג‬€™s on-premises network.
However, you find that you cannot establish a connection to VirtualNetworkB from the Windows 10 workstation.
You have to make sure that a connection to VirtualNetworkB can be established from the Windows 10 workstation.
Solution: You choose the Allow gateway transit setting on VirtualNetworkA.
A. Yes
B. No
U
Correct Answer: B
R
Reference:
U
G
SS
PA

AM

peering between
EX
Solution: You choose the Allow gateway transit setting on VirtualNetworkB.
A. Yes
B. No
Correct Answer: B
Reference:
peering between
Solution: You download and re-install the VPN client configuration package on the Windows 10 workstation.
A. Yes
B. No
Correct Answer: A
U
Reference:
R
U
G
SS
Your company has virtual machines (VMs) hosted in Microsoft Azure. The VMs are located in a single Azure virtual network named VNet1.
The company has users that work remotely. The remote workers require access to the VMs on VNet1.
You need to provide access for the remote workers.
PA
What should you do?
A. Configure a Site-to-Site (S2S) VPN.

AM
B. Configure a VNet-toVNet VPN.
C. Configure a Point-to-Site (P2S) VPN.

EX
D. Configure DirectAccess on a Windows Server 2012 server VM.
E. Configure a Multi-Site VPN
Correct Answer: C
A Point-to-Site (P2S) VPN gateway connection lets you create a secure connection to your virtual network from an individual client computer.
Reference:
https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpngateways
Your company has a Microsoft SQL Server Always On availability group configured on their Azure virtual machines (VMs).
Solution: You create an HTTP health probe on port 1433.
A. Yes
B. No
Correct Answer: B
U
R
Solution: You set Session persistence to Client IP.
Does the solution meet the goal? U
G
SS
A. Yes
B. No
PA
Correct Answer: B
Reference:
https://docs.microsoft.com/en-us/azure/virtual-machines/windows/sql/virtual-machines-windows-portal-sql-alwayson-int-listener
AM

EX
Solution: You enable Floating IP.
A. Yes
B. No
Correct Answer: A
Your company has two on-premises servers named SRV01 and SRV02. Developers have created an application that runs on SRV01. The
application calls a service on SRV02 by IP address.
You plan to migrate the application on Azure virtual machines (VMs). You have configured two VMs on a single subnet in an Azure virtual network.
You need to configure the two VMs with static internal IP addresses.
What should you do?
A. Run the New-AzureRMVMConfig PowerShell cmdlet.
B. Run the Set-AzureSubnet PowerShell cmdlet.
C. Modify the VM properties in the Azure Management Portal.
D. Modify the IP properties in Windows Network and Sharing Center.
E. Run the Set-AzureStaticVNetIP PowerShell cmdlet.
Correct Answer: E
Specify a static internal IP for a previously created VM
If you want to set a static IP address for a VM that you previously created, you can do so by using the following cmdlets. If you already set an IP
address for the
U
VM and you want to change it to a different IP address, you‫ג‬€™ll need to remove the existing static IP address before running these cmdlets.
See the instructions below to remove a static IP.
R
For this procedure, you‫ג‬€™ll use the Update-AzureVM cmdlet. The Update-AzureVM cmdlet restarts the VM as part of the update process. The
DIP that you specify will be assigned after the VM restarts. In this example, we set the IP address for VM2, which is located in cloud service
StaticDemo.
U
G
Get-AzureVM -ServiceName StaticDemo -Name VM2 | Set-AzureStaticVNetIP -IPAddress 192.168.4.7 | Update-AzureVM
SS

PA

You need to deploy five virtual machines (VMs) to your company‫ג‬€™s virtual network subnet.
The VMs will each have both a public and private IP address. Inbound and outbound security rules for all of these virtual machines must be
AM
identical.
Which of the following is the least amount of network interfaces needed for this configuration?
EX
A. 5
B. 10
C. 20
D. 40
Correct Answer: A

You need to deploy five virtual machines (VMs) to your company‫ג‬€™s virtual network subnet.
The VMs will each have both a public and private IP address. Inbound and outbound security rules for all of these virtual machines must be
identical.
Which of the following is the least amount of security groups needed for this configuration?
A. 4
B. 3
C. 2
D. 1
Correct Answer: D
U
Your company‫ג‬€™s Azure subscription includes Azure virtual machines (VMs) that run Windows Server 2016.
One of the VMs is backed up every day using Azure Backup Instant Restore.
R
When the VM becomes infected with data encrypting ransomware, you decide to recover the VM‫ג‬€™s files.
Which of the following is TRUE in this scenario?
U
G
A. You can only recover the files to the infected VM.
B. You can recover the files to any VM within the company‫ג‬€™s subscription.
SS
C. You can only recover the files to a new VM.
D. You will not be able to recover the files.

PA
Correct Answer: A
AM

EX
Your company‫ג‬€™s Azure subscription includes Azure virtual machines (VMs) that run Windows Server 2016.
One of the VMs is backed up every day using Azure Backup Instant Restore.
When the VM becomes infected with data encrypting ransomware, you are required to restore the VM.
Which of the following actions should you take?
A. You should restore the VM after deleting the infected VM.
B. You should restore the VM to any VM within the company‫ג‬€™s subscription.
C. You should restore the VM to a new Azure VM.
D. You should restore the VM to an on-premise Windows device.
Correct Answer: B
You administer a solution in Azure that is currently having performance issues.

You need to find the cause of the performance issues pertaining to metrics on the Azure infrastructure.
Which of the following is the tool you should use?
A. Azure Traffic Analytics
B. Azure Monitor
C. Azure Activity Log
D. Azure Advisor
Correct Answer: B
Metrics in Azure Monitor are stored in a time-series database which is optimized for analyzing time-stamped data. This makes metrics
particularly suited for alerting and fast detection of issues.
Reference:
https://docs.microsoft.com/en-us/azure/azure-monitor/platform/data-platform
U
R
Your company has an Azure subscription that includes a Recovery Services vault.
U
You want to use Azure Backup to schedule a backup of your company's virtual machines (VMs) to the Recovery Services vault.
G
Which of the following VMs can you back up? Choose all that apply.
SS
A. VMs that run Windows 10.
B. VMs that run Windows Server 2012 or higher.

PA
C. VMs that have NOT been shut down.
D. VMs that run Debian 8.2+.

AM
E. VMs that have been shut down.
Correct Answer: ABCDE

Azure Backup supports backup of 64-bit Windows server operating system from Windows Server 2008.
EX

Azure Backup supports backup of 64-bit Debian operating system from Debian 7.9+.
Azure Backup supports backup of VM that are shutdown or offiine.
Reference:
https://docs.microsoft.com/en-us/azure/backup/backup-support-matrix-iaas https://docs.microsoft.com/en-us/azure/virtual-
machines/linux/endorsed-distros
Topic 2 - Question Set 2

Question #1 Topic 2
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that
might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure subscription that contains the following users in an Azure Active Directory tenant named contoso.onmicrosoft.com:

A. Yes
B. No
U
R
Correct Answer: A
Reference:
U
G
SS
PA
AM
EX
Question #2 Topic 2

A. Yes
B. No
U
R
Correct Answer: B
Reference:
U
G
SS
Question #3 Topic 2
PA
AM
EX

A. Yes
B. No
Correct Answer: B
Reference:
Question #4 Topic 2
HOTSPOT -
You have an Azure subscription named Subscription1 that contains a resource group named RG1.
You need to ensure that an administrator named Admin1 can manage LB1 and LB2. The solution must follow the principle of least privilege.
Which role should you assign to Admin1 for each task? To answer, select the appropriate options in the answer area.
Hot Area:
U
R
U
G
SS
PA
Correct Answer:
AM
EX
Reference:
Question #5 Topic 2
You have an Azure subscription that contains an Azure Active Directory (Azure AD) tenant named contoso.com and an Azure Kubernetes Service
(AKS) cluster named AKS1.
C. Recreate AKS1.
Correct Answer: B
Reference:
U
Question #6 Topic 2
R
You have a Microsoft 365 tenant and an Azure Active Directory (Azure AD) tenant named contoso.com.
U
You plan to grant three users named User1, User2, and User3 access to a temporary Microsoft SharePoint document library named Library1.
You need to create groups for the users. The solution must ensure that the groups are deleted automatically after 180 days.
G
SS
A. a Microsoft 365 group that uses the Assigned membership type

PA
C. a Microsoft 365 group that uses the Dynamic User membership type

AM
Correct Answer: AC
EX
Note: With the increase in usage of Office 365 Groups, administrators and users need a way to clean up unused groups. Expiration policies can
help remove inactive groups from the system and make things cleaner.
When a group expires, all of its associated services (the mailbox, Planner, SharePoint site, etc.) are also deleted.
Incorrect Answers:
B, D, E: You can set expiration policy only for Office 365 groups in Azure Active Directory (Azure AD).
Reference:
https://docs.microsoft.com/en-us/office365/admin/create-groups/office-365-groups-expiration-policy?view=o365-worldwide
Question #7 Topic 2
HOTSPOT -
You have an Azure Active Directory (Azure AD) tenant named contoso.com that contains the users shown in the following table:

U
R
U
G
SS
PA
AM
EX
Hot Area:
Correct Answer:
U
R
U
G
Reference:
SS
PA
AM
EX
Question #8 Topic 2
HOTSPOT -
U
Hot Area:
R
U
G
SS
PA
AM
Correct Answer:
EX
Box 1: No -
Box 2: Yes -
Virtual Machines can be created on a Management Group provided the user has the required RBAC permissions.
Box 3: Yes -
Subscriptions can be moved between Management Groups provided the user has the required RBAC permissions.
Reference:
https://docs.microsoft.com/en-us/azure/governance/management-groups/overview https://docs.microsoft.com/en-
us/azure/governance/management-groups/manage#moving-management-groups-and-subscriptions
Question #9 Topic 2
U
R
U
G
SS
PA
AM
EX
Correct Answer: B
You are prevented from creating Azure SQL servers anywhere in Subscription 1 with the exception of ContosoRG1
HOTSPOT -

Which tags apply to VNET1 and VNET2? To answer, select the appropriate options in the answer area.
U
Hot Area:
R
U
G
SS
PA
AM
EX
Correct Answer:

Note: Azure Policy allows you to use either built-in or custom-defined policy definitions and assign them to either a specific resource group or
across a whole
Azure subscription.
Incorrect Answers:
RGROUP: RG6 -
Reference:
You have an Azure subscription named AZPT1 that contains the resources shown in the following table:

U
R
C. VM1, storage1, VNET1, VM1Managed, and RVAULT1 U

G
D. RVAULT1 only
SS
Correct Answer: C
You can move a VM and its associated resources to a different subscription by using the Azure portal.
PA
You can now move an Azure Recovery Service (ASR) Vault to either a new resource group within the current subscription or to a new
subscription.
Reference:
AM
https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/move-resource-group-and-subscription
EX
Admin1 attempts to deploy an Azure Marketplace resource by using an Azure Resource Manager template. Admin1 deploys the template by using
Azure
PowerShell and receives the following error message: ‫ג‬€User failed validation to purchase resources. Error message: ‫ג‬€Legal terms have not been
accepted for this item on this subscription. To accept legal terms, please go to the Azure portal (http://go.microsoft.com/fwlink/?LinkId=534873)
and configure programmatic deployment for the Marketplace item or create it there for the first time.‫ג‬€
What should you do?
Correct Answer: C
Reference:
https://docs.microsoft.com/en-us/powershell/module/az.marketplaceordering/set-azmarketplaceterms?view=azps-4.1.0
U
R
U
G
SS

PA

AM
Correct Answer: B
EX
Assign a role to a user -

1. Sign in to the Azure portal with an account that's a global admin or privileged role admin for the directory.
3. For the selected user, select Directory role, select Add role, and then pick the appropriate admin roles from the Directory roles list, such as
Conditional access administrator.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-users-assign-role-azure-portal
You have an Azure Active Directory (Azure AD) tenant named contoso.onmicrosoft.com that contains 100 user accounts.
What should you do?
Correct Answer: A
Reference:
U
You have an Azure subscription named Subscription1 and an on-premises deployment of Microsoft System Center Service Manager.
R
U
You need to ensure that an alert is set in Service Manager when the amount of available memory on VM1 is below 10 percent.
G
SS

PA
AM
Correct Answer: C
The IT Service Management Connector (ITSMC) allows you to connect Azure and a supported IT Service Management (ITSM) product/service,
such as the
EX
With ITSMC, you can create work items in ITSM tool, based on your Azure alerts (metric alerts, Activity Log alerts and Log Analytics alerts).
Reference:

You need to add a user named admin1@contoso.com as an administrator on all the computers that will be joined to the Azure AD domain.
A. Device settings from the Devices blade
B. Providers from the MFA Server blade
C. User settings from the Users blade
D. General settings from the Groups blade
Correct Answer: A
When you connect a Windows device with Azure AD using an Azure AD join, Azure AD adds the following security principles to the local
administrators group on the device:
✑ The Azure AD global administrator role
✑ The Azure AD device administrator role
✑ The user performing the Azure AD join
In the Azure portal, you can manage the device administrator role on the Devices page. To open the Devices page:
U
R
U
5. To modify the device administrator role, configure Additional local administrators on Azure AD joined devices.
G
Reference:
SS
PA
AM
EX
HOTSPOT -
Hot Area:
U
R
U
G
SS
PA
Correct Answer:
AM
EX
Box 1: Yes -
Note: Assigned groups - Manually add users or devices into a static group.
Azure AD joined or hybrid Azure AD joined devices utilize an organizational account in Azure AD
Box 2: No -
Note: Azure AD registered devices utilize an account managed by the end user, this account is either a Microsoft account or another locally
managed credential.
Box 3: Yes -
Reference:
U
R
U
RG26 is set to the West Europe location and is used to create temporary resources for a project. RG26 contains the resources shown in the
following table.
G
SS
PA

When the project is complete, you attempt to delete RG26 from the Azure portal. The deletion fails.
AM

EX
A. Delete VM1
B. Stop VM1
D. Delete sa001
Correct Answer: C
You have an Azure subscription named Subscription1 that contains a virtual network named VNet1. VNet1 is in a resource group named RG1.
✑ Reader
✑ Security Admin
✑ Security Reader
What should you do?
A. Remove User1 from the Security Reader and Reader roles for Subscription1.
B. Assign User1 the User Access Administrator role for VNet1.
C. Assign User1 the Network Contributor role for VNet1.
Correct Answer: B
Note:
There are several versions of this question in the exam. The question can have other incorrect answer options, including the following:
U
1. Name Server (NS)
R
2. Assign User1 the Contributor role for VNet1.
3. Remove User1 from the Security Reader and Reader roles for Subscription1. Assign User1 the Contributor role for Subscription1.
Reference:
U
G
SS
PA
AM
EX
A. MX
B. NSEC
C. PTR
D. RRSIG
Correct Answer: A
To verify your custom domain name (example)
1. Sign in to the Azure portal using a Global administrator account for the directory.
2. Select Azure Active Directory, and then select Custom domain names.
3. On the Fabrikam - Custom domain names page, select the custom domain name, Contoso.
4. On the Contoso page, select Verify to make sure your custom domain is properly registered and is valid for Azure AD. Use either the TXT or
U
the MX record type.
R
Note:
There are several versions of this question in the exam. The question can have two correct answers:
1. MX
U
G
2. TXT
The question can also have other incorrect answer options, including the following:
SS
1. SRV
2. NSEC3
Reference:
PA
https://docs.microsoft.com/en-us/azure/dns/dns-web-sites-custom-domain
AM
EX
You have an Azure Directory (Azure AD) tenant named Adatum and an Azure Subscription named Subscription1. Adatum contains a group named
Developers.
Subscription1 contains a resource group named Dev.
You need to provide the Developers group with the ability to create Azure logic apps in the Dev resource group.
A. Yes
B. No
Correct Answer: B
DevTest Labs User role only lets you connect, start, restart, and shutdown virtual machines in your Azure DevTest Labs.
The Logic App Contributor role lets you manage logic app, but not access to them. It provides access to view, edit, and update a logic app.
Reference:
https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles https://docs.microsoft.com/en-us/azure/logic-apps/logic-
apps-securing-a-logic-app
Developers.
A. Yes
B. No
Correct Answer: B
Reference:
U
https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles https://docs.microsoft.com/en-us/azure/logic-apps/logic-
apps-securing-a-logic-app
R
G
SS
PA
Developers.
AM
EX
A. Yes
B. No
Correct Answer: A
DRAG DROP -
You have an Azure subscription that is used by four departments in your company. The subscription contains 10 resource groups. Each
department uses resources in several resource groups.
You need to send a report to the finance department. The report must detail the costs for each department.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and
arrange them in the correct order.
Select and Place:
U
R
U
G
SS
Correct Answer:
PA
AM

EX
You apply tags to your Azure resources giving metadata to logically organize them into a taxonomy. After you apply tags, you can retrieve all the
resources in your subscription with that tag name and value. Each resource or resource group can have a maximum of 15 tag name/value pairs.
Box 2: From the Cost analysis blade, filter the view by tag
After you get your services running, regularly check how much they're costing you. You can see the current spend and burn rate in Azure portal.
1. Visit the Subscriptions blade in Azure portal and select a subscription.
You should see the cost breakdown and burn rate in the popup blade.
2. Click Cost analysis in the list to the left to see the cost breakdown by resource. Wait 24 hours after you add a service for the data to
populate.
3. You can filter by different properties like tags, resource group, and timespan. Click Apply to confirm the filters and Download if you want to
export the view to a
Comma-Separated Values (.csv) file.
Reference:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-using-tags https://docs.microsoft.com/en-
us/azure/billing/billing-getting-started
You have an Azure subscription named Subscription1 that contains an Azure Log Analytics workspace named Workspace1.
A. Get-Event Event | where {$_.EventType == "error"}
B. search in (Event) "error"
C. select * from Event where EventType == "error"
D. search in (Event) * | where EventType -eq "error"
Correct Answer: B
To search a term in a specific table, add the table-name just after the search operator
Note:
U
There are several versions of this question in the exam. The question has two possible correct answers:
1. Event | search "error"
R
2. Event | where EventType == "error"
3. search in (Event) "error"
Other incorrect answer options you may see on the exam include the following:
U
G
1. Get-Event Event | where {$_.EventTye ‫ג‬€"eq "error"}
2. Event | where EventType is "error"
SS
3. search in (Event) * | where EventType ‫ג‬€"eq "error"

4. select * from Event where EventType is "error"
Reference:
PA
https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/search-queries https://docs.microsoft.com/en-us/azure/azure-monitor/log-
query/get-started-portal https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/searchoperator?pivots=azuredataexplorer
AM
EX
HOTSPOT -
You have an Azure subscription that contains a virtual network named VNET1 in the East US 2 region. A network interface named VM1-NI is
connected to
VNET1.
You successfully deploy the following Azure Resource Manager template.
U
R
U
G
SS
PA
AM
EX
Hot Area:
Correct Answer:
U
R
U
G
Box 1: Yes -
SS
Box 2: Yes -
PA
Box 3: No -
Reference:
AM
EX
You have an Azure subscription named Subscription1. Subscription1 contains the resource groups in the following table.
Correct Answer: A
You can move an app to another App Service plan, as long as the source plan and the target plan are in the same resource group and
geographical region.
U
The region in which your app runs is the region of the App Service plan it's in. However, you cannot change an App Service plan's region.
Reference:
R
U
G
SS
PA
AM
EX
HOTSPOT -
You have an Azure subscription named Subscription1 that has a subscription ID of c276fc76-9cd4-44c9-99a7-4fd71546436e.
✑ Can be assigned only to the resource groups in Subscription1
✑ Prevents the management of the access permissions for the resource groups
✑ Allows the viewing, creating, modifying, and deleting of resources within the resource groups
What should you specify in the assignable scopes and the permission elements of the definition of CR1? To answer, select the appropriate options
in the answer area.
Hot Area:
U
R
U
G
SS
PA
AM
EX
Correct Answer:
U
R
U
G
Reference:
https://docs.microsoft.com/en-us/azure/role-based-access-control/custom-roles https://docs.microsoft.com/en-us/azure/role-based-access-
SS
control/resource-provider-operations#microsoftresources
PA
AM
EX

Users access the resources in the subscription from either home or from customer sites. From home, users must establish a point-to-site VPN to
access the Azure resources. The users on the customer sites access the Azure resources by using site-to-site VPNs.
You have a line-of-business-app named App1 that runs on several Azure virtual machine. The virtual machines run Windows Server 2016.
What are two possible Azure services that you can use? Each correct answer presents a complete solution.
D. Traffic Manager
Correct Answer: AE
Network traffic from the VPN gateway is routed to the cloud application through an internal load balancer. The load balancer is located in the
U
front-end subnet of the application.
Reference:
R
https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/vpn https://docs.microsoft.com/en-
us/azure/load-balancer/load-balancer-overview https://docs.microsoft.com/en-us/azure/application-gateway/overview
U
G
SS

PA
You need to quickly identify underutilized virtual machines that can have their service tier changed to a less expensive offering.
AM
A. Monitor
B. Advisor
EX
C. Metrics
Correct Answer: B
Advisor helps you optimize and reduce your overall Azure spend by identifying idle and underutilized resources. You can get cost
recommendations from the Cost tab on the Advisor dashboard.
Reference:
HOTSPOT -
You need to create a conditional access policy that requires all users to use multi-factor authentication when they access the Azure portal.
Which three settings should you configure? To answer, select the appropriate settings in the answer area.
Hot Area:
U
R
U
G
SS
PA
AM
EX
Correct Answer:
U
R
U
G
SS
Reference:
PA
AM
EX
Admin1 attempts to invite the external partner to sign in to the Azure AD tenant and receives the following error message: ‫ג‬€Unable to invite user
user1@outlook.com ‫ג‬€" Generic authorization exception.‫ג‬€
What should you do?
A. From the Users blade, modify the External collaboration settings.
B. From the Custom domain names blade, add a custom domain.
C. From the Organizational relationships blade, add an identity provider.
D. From the Roles and administrators blade, assign the Security administrator role to Admin1.
Correct Answer: A
Reference:
https://techcommunity.microsoft.com/t5/Azure-Active-Directory/Generic-authorization-exception-inviting-Azure-AD-gests/td-p/274742
U
R
U
G
SS
PA
AM
EX
You have an Azure subscription linked to an Azure Active Directory tenant. The tenant includes a user account named User1.
What should you do?
A. Assign the Owner role for the Azure Subscription to User1, and then modify the default conditional access policies.
B. Assign the Owner role for the Azure subscription to User1, and then instruct User1 to configure access management for Azure resources.
C. Assign the Global administrator role to User1, and then instruct User1 to configure access management for Azure resources.
D. Create a new management group and delegate User1 as the owner of the new management group.
Correct Answer: B
U
R
U
G
SS
Note:
Each directory is given a single top-level management group called the "Root" management group. This root management group is built into the
hierarchy to have all management groups and subscriptions fold up to it. This root management group allows for global policies and Azure role
PA
assignments to be applied at the directory level. The Azure AD Global Administrator needs to elevate themselves to the User Access
Administrator role of this root group initially. After elevating access, the administrator can assign any Azure role to other directory users or
groups to manage the hierarchy. As administrator, you can assign your own account as owner of the root management group.
AM
Reference:
EX
HOTSPOT -
You have an Azure Active Directory (Azure AD) tenant named adatum.com. Adatum.com contains the groups in the following table.
Of which groups are User1 and User2 members? To answer, select the appropriate options in the answer area.
Hot Area:
U
R
U
G
SS
PA
AM
EX
Correct Answer:
Box 1: Group 1 only -
First rule applies -
Box 2: Group1 and Group2 only -

Reference:
HOTSPOT -
You have a hybrid deployment of Azure Active Directory (Azure AD) that contains the users shown in the following table.
For which users can you modify the attributes from Azure AD? To answer, select the appropriate options in the answer area.
U
Hot Area:
R
U
G
SS
PA
AM
EX
Correct Answer:
Box 1: User1 and User3 only -

You must use Windows Server Active Directory to update the identity, contact info, or job info for users whose source of authority is Windows
Server Active
Directory.
Box 2: User1, User2, and User3 -

Reference:
https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-users-profile-azure-portal
You need to ensure that an Azure Active Directory (Azure AD) user named Admin1 is assigned the required role to enable Traffic Analytics for an
Azure subscription.
A. Yes
B. No
Correct Answer: A
Your account must have any one of the following Azure roles at the subscription scope: owner, contributor, reader, or network contributor.
Reference:
U
R
U
G
SS
Azure subscription.
PA
AM
A. Yes
B. No
EX
Correct Answer: A
Reference:
Azure subscription.
A. Yes
B. No
Correct Answer: A
Reference:
U
R
Question #39
U Topic 2
G
SS
You need to ensure that User1 can deploy virtual machines and manage virtual networks. The solution must use the principle of least privilege.
PA
A. Owner
B. Virtual Machine Contributor

AM
C. Contributor
D. Virtual Machine Administrator Login

EX
Correct Answer: B
Virtual Machine Contributor: Lets you manage virtual machines, but not access to them, and not the virtual network or storage account they're
connected to.
Incorrect Answers:
A: Owner: Grants full access to manage all resources, including the ability to assign roles in Azure RBAC.
C: Contributor: Grants full access to manage all resources, but does not allow you to assign roles in Azure RBAC.
D: Virtual Machine Administrator Login: View Virtual Machines in the portal and login as administrator.
Reference:
HOTSPOT -
You have an Azure Active Directory (Azure AD) tenant that contains three global administrators named Admin1, Admin2, and Admin3.
The tenant is associated to an Azure subscription. Access control for the subscription is configured as shown in the Access control exhibit. (Click
the Access
Control tab.)
U
R
U
G
SS
You sign in to the Azure portal as Admin1 and configure the tenant as shown in the Tenant exhibit. (Click the Tenant tab.)
PA
AM
EX
Hot Area:
Correct Answer:
U
R
Box 1: No -
U
G
Only Admin3, the owner, can assign ownership.
SS
Box 2: Yes -
Box 3: No -
PA
Reference:
https://docs.microsoft.com/en-us/azure/cost-management-billing/manage/add-change-subscription-administrator
AM
EX
You have an Azure subscription named Subscription1 that contains an Azure virtual machine named VM1. VM1 is in a resource group named RG1.
You need to ensure that a service running on VM1 can manage the resources in RG1 by using the identity of VM1.
A. From the Azure portal, modify the Managed Identity settings of VM1
B. From the Azure portal, modify the Access control (IAM) settings of RG1
C. From the Azure portal, modify the Access control (IAM) settings of VM1
D. From the Azure portal, modify the Policies settings of RG1
Correct Answer: A
Managed identities for Azure resources provides Azure services with an automatically managed identity in Azure Active Directory. You can use
this identity to authenticate to any service that supports Azure AD authentication, without having credentials in your code.
You can enable and disable the system-assigned managed identity for VM using the Azure portal.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/qs-configure-portal-windows-vm
U
R
U
G
SS
PA

AM
A. Modify the backup configurations of VM1 and modify the resource lock type of VNET1
EX
B. Remove the resource lock from VNET1 and delete all data in Vault1
C. Turn off VM1 and remove the resource lock from VNET1
D. Turn off VM1 and delete all data in Vault1
Correct Answer: C
When you delete a resource group, all of its resources are also deleted. Deleting a resource group deletes all of its template deployments and
currently stored operations.
Reference:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/delete-resource-group?tabs=azure-powershell

You need to delegate a subdomain named research.adatum.com to a different DNS server in Azure.
What should you do?
A. Create an NS record named research in the adatum.com zone.
B. Create a PTR record named research in the adatum.com zone.
C. Modify the SOA record of adatum.com.
D. Create an A record named *.research in the adatum.com zone.
Correct Answer: A
Reference:
U
R
U
G
SS
PA
AM
EX
DRAG DROP -
You have an Azure Active Directory (Azure AD) tenant that has the contoso.onmicrosoft.com domain name.
You have a domain name of contoso.com registered at a third-party registrar.
You need to ensure that you can create Azure AD users that have names containing a suffix of @contoso.com.
Select and Place:
U
R
U
G
SS
PA
Correct Answer:
AM
EX
1. Add the custom domain name to your directory

2. Add a DNS entry for the domain name at the domain name registrar
3. Verify the custom domain name in Azure AD
Reference:
You have an Azure subscription named Subscription1 that contains an Azure Log Analytics workspace named Workspace1.
A. Get-Event Event | where {$_.EventType == "error"}
C. select * from Event where EventType == "error"
Correct Answer: B
The search operator provides a multi-table/multi-column search experience.
The syntax is:
Table_name | search "search term"
Note:
There are several versions of this question in the exam. The question has three possible correct answers:
1. search in (Event) "error"
2. Event | search "error"
U
3. Event | where EventType == "error"
R
1. Get-Event Event | where {$_.EventTye ‫ג‬€"eq "error"}
2. Event | where EventType is "error"
U
G
3. select * from Event where EventType is "error"
4. search in (Event) * | where EventType ‫ג‬€"eq "error"
SS
Reference:
https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/search-queries https://docs.microsoft.com/en-us/azure/azure-monitor/log-
query/get-started-portal https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/searchoperator?pivots=azuredataexplorer
PA
AM
You have a registered DNS domain named contoso.com.

You create a public Azure DNS zone named contoso.com.
EX
You need to ensure that records created in the contoso.com zone are resolvable from the internet.
What should you do?
A. Create NS records in contoso.com.
B. Modify the SOA record in the DNS domain registrar.
C. Create the SOA record in contoso.com.
D. Modify the NS records in the DNS domain registrar.
Correct Answer: D
Reference:
HOTSPOT -
You have an Azure subscription that contains a storage account named storage1. The subscription is linked to an Azure Active Directory (Azure
AD) tenant named contoso.com that syncs to an on-premises Active Directory domain.
The domain contains the security principals shown in the following table.
In Azure AD, you create a user named User2.

The storage1 account contains a file share named share1 and has the following configurations.
U
R
Hot Area:
U
G
SS
PA
Correct Answer:
AM
EX
Reference:
https://docs.microsoft.com/en-us/azure/storage/files/storage-files-identity-ad-ds-assign-permissions?tabs=azure-portal
HOTSPOT -
You have an Azure subscription named Subscription1 that contains a virtual network VNet1.
You add the users in the following table.
Which user can perform each configuration? To answer, select the appropriate options in the answer area.
Hot Area:
U
R
U
G
SS
Correct Answer:
PA
AM
EX
Box 1: User1 and User3 only.

User1: The Owner Role lets you manage everything, including access to resources.
User3: The Network Contributor role lets you manage networks, including creating subnets.
Box 2: User1 only.
The Security Admin role: In Security Center only: Can view security policies, view security states, edit security policies, view alerts and
recommendations, dismiss alerts and recommendations.
Reference:
https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles https://docs.microsoft.com/en-us/azure/role-based-access-
control/resource-provider-operations#microsoftnetwork
EX
AM
PA
SS
G
U
R
U
HOTSPOT -
You have the Azure resources shown on the following exhibit.
You plan to track resource usage and prevent the deletion of resources.
To which resources can you apply locks and tags? To answer, select the appropriate options in the answer area.
Hot Area:
U
R
U
G
SS
PA
AM
EX
Correct Answer:
Box 1: Sub1, RG1, and VM1 only -

You can lock a subscription, resource group, or resource to prevent other users in your organization from accidentally deleting or modifying
critical resources.
U
R
Box 2: Sub1, RG1, and VM1 only -
You apply tags to your Azure resources, resource groups, and subscriptions.
Reference:
U
https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources?tabs=json https://docs.microsoft.com/en-
G
us/azure/azure-resource-manager/management/tag-resources?tabs=json
SS

PA
Question #1 Topic 3
AM
You have an Azure Storage account named storage1 that contains a blob container named container1.
You need to prevent new content added to container1 from being modified for one year.
EX
A. the access tier
B. an access policy
C. the Access control (IAM) settings
D. the access level
Correct Answer: B
Reference:
https://docs.microsoft.com/en-us/azure/storage/blobs/immutable-storage-overview?tabs=azure-portal
Question #2 Topic 3
HOTSPOT -
You have an Azure Storage account named storage1 that contains a blob container. The blob container has a default access tier of Hot. Storage1
contains a container named conainer1.
You create lifecycle management rules in storage1 as shown in the following table.
You perform the actions shown in the following table.
U
R
U
G
Hot Area:
SS
PA
AM
Correct Answer:
EX
Question #3 Topic 3

You need to copy the contents of D:\Folder1 to the public container in an Azure Storage account named contosodata.
B. azcopy sync D:\folder1 https://contosodata.blob.core.windows.net/public --snapshot
C. azcopy copy D:\folder1 https://contosodata.blob.core.windows.net/public --recursive
D. az storage blob copy start-batch D:\Folder1 https://contosodata.blob.core.windows.net/public
Correct Answer: C
The azcopy copy command copies a directory (and all of the files in that directory) to a blob container. The result is a directory in the container
by the same name.
Incorrect Answers:
B: The azcopy sync command replicates the source location to the destination location. However, the file is skipped if the last modified time in
the destination is more recent.
Reference:
U
https://docs.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-blobs https://docs.microsoft.com/en-
R
us/azure/storage/common/storage-ref-azcopy-copy
U
G
Question #4 Topic 3
SS

In the Azure portal, you plan to create a storage account named storage1 that will have the following settings:
✑ Performance: Standard
PA
✑ Replication: Zone-redundant storage (ZRS)

✑ Access tier (default): Cool
✑ Hierarchical namespace: Disabled
AM
You need to ensure that you can set Account kind for storage1 to BlockBlobStorage.
Which setting should you modify first?
EX
A. Performance
B. Replication
C. Access tier (default)
D. Hierarchical namespace
Correct Answer: A
Reference:
https://docs.microsoft.com/en-us/azure/storage/common/storage-account-overview https://docs.microsoft.com/en-
us/azure/storage/blobs/storage-blob-performance-tiers
Question #5 Topic 3
You have an Azure subscription named Subscription1 that contains the storage accounts shown in the following table:
A. storage1
B. storage2
C. storage3
D. storage4
Correct Answer: D
U
✑ Standard General Purpose v2 storage accounts (recommended for most scenarios)
R
✑ Blob Storage accounts
✑ General Purpose v1 storage accounts (both Classic or Azure Resource Manager deployments),
U
G
✑ Import supports Azure Blob storage and Azure File storage
✑ Export supports Azure Blob storage
SS
Reference:
PA
AM
EX
Question #6 Topic 3
HOTSPOT -
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
Hot Area:
U
R
U
G
SS
PA
AM
Correct Answer:
EX
Box 2: All the storage accounts -

Note: The three different storage account options are: General-purpose v2 (GPv2) accounts, General-purpose v1 (GPv1) accounts, and Blob
storage accounts.
✑ General-purpose v2 (GPv2) accounts are storage accounts that support all of the latest features for blobs, files, queues, and tables.
✑ Blob storage accounts support all the same block blob features as GPv2, but are limited to supporting only block blobs.
✑ General-purpose v1 (GPv1) accounts provide access to all Azure Storage services, but may not have the latest features or the lowest per
gigabyte pricing.
Reference:
Question #7 Topic 3
U
R
Which data should you identify? U
G
SS
A. DB1
B. container1
C. share1
PA
D. Table1
AM
Correct Answer: B
EX
Question #8 Topic 3
HOTSPOT -
You have an Azure App Service app named App1 and an app named App2 that runs in an Azure container instance. Each app uses a managed
identity.
You need to ensure that App1 and App2 can read blobs from storage1. The solution must meet the following requirements:
✑ Minimize the number of secrets used.
✑ Ensure that App2 can only read from storage1 for the next 30 days.
What should you configure in storage1 for each app? To answer, select the appropriate options in the answer area.
Hot Area:
U
R
U
G
SS
PA
AM
Correct Answer:
EX
App1: Access keys -

A shared access signature (SAS) provides secure delegated access to resources in your storage account without compromising the security of
your data. With a
SAS, you have granular control over how a client can access your data. You can control what resources the client may access, what permissions
they have on those resources, and how long the SAS is valid, among other parameters.
Reference:
Question #9 Topic 3
HOTSPOT -
✑ Minimizes costs
✑ Supports hot, cool, and archive blob tiers
✑ Provides fault tolerance if a disaster affects the Azure region where the account resides
How should you complete the command? To answer, select the appropriate options in the answer area.
Hot Area:
U
R
U
G
SS
PA
AM
Correct Answer:
EX
Box 1: StorageV2 -
You may only tier your object storage data to hot, cool, or archive in Blob storage and General Purpose v2 (GPv2) accounts. General Purpose v1
(GPv1) accounts do not support tiering.
General-purpose v2 accounts deliver the lowest per-gigabyte capacity prices for Azure Storage, as well as industry-competitive transaction
prices.
Box 2: Standard_GRS -
Geo-redundant storage (GRS): Cross-regional replication to protect against region-wide unavailability.
Incorrect Answers:
Locally-redundant storage (LRS): A simple, low-cost replication strategy. Data is replicated within a single storage scale unit.
Read-access geo-redundant storage (RA-GRS): Cross-regional replication with read access to the replica. RA-GRS provides read-only access to
the data in the secondary location, in addition to geo-replication across two regions, but is more expensive compared to GRS.
Reference:
https://docs.microsoft.com/en-us/azure/storage/common/storage-redundancy-grs https://docs.microsoft.com/en-
us/azure/storage/blobs/storage-blob-storage-tiers
You need to synchronize the files in the file share named data to an on-premises server named Server1.
B. Register Server1
U
Correct Answer: BCE
R
Step 1 (C): Install the Azure File Sync agent on Server1
The Azure File Sync agent is a downloadable package that enables Windows Server to be synced with an Azure file share
U
G
Registering your Windows Server with a Storage Sync Service establishes a trust relationship between your server (or cluster) and the Storage
SS
Sync Service.
A sync group defines the sync topology for a set of files. Endpoints within a sync group are kept in sync with each other. A sync group must
PA
contain one cloud endpoint, which represents an Azure file share and one or more server endpoints. A server endpoint represents a path on
registered server.
Reference:
AM
EX
HOTSPOT -

U
R
U
G
SS
PA
AM
EX

Hot Area:
Correct Answer:
U
R
U
G
SS
PA
AM
EX
DRAG DROP -
You have an on-premises server named Server1 that runs Windows Server 2016. Server1 has 2 TB of data.
In which order should you perform the actions? To answer, move all actions from the list of actions to the answer area and arrange them in the
correct order.
NOTE: More than one order of answer choices is correct. You will receive credit for any of the correct orders you select.
Select and Place:
U
R
U
G
SS
Correct Answer:
PA

AM

Determine data to be imported, number of drives you need, destination blob location for your data in Azure storage.
EX

The drives are shipped using your carrier account to the return address provided in the import job.
Reference:
HOTSPOT -
You create a Storage Sync Service named Sync1 and an Azure File Sync group named Group1. Group1 uses share1 as a cloud endpoint.
You register Server1 and Server2 in Sync1. You add D:\Folder1 on Server1 as a server endpoint of Group1.
Hot Area:
U
R
U
G
SS
Correct Answer:
PA
AM
EX
Box 1: No -
A sync group must contain one cloud endpoint, which represents an Azure file share and one or more server endpoints.
Box 2: Yes -
Box 3: Yes -
Reference:
DRAG DROP -
You create an Azure Storage account named contosostorage, and then you create a file share named data.
Which UNC path should you include in a script that references files from the data file share? To answer, drag the appropriate values to the correct
targets. Each value may be used once, more than once or not at all. You may need to drag the split bar between panes or scroll to view content.
Select and Place:
Correct Answer:
U
R
U
G
SS
Box 1: contosostorage -
PA
The name of account -

AM
Box 2: file.core.windows.net -
Box 3: data -
EX

Example:
Reference:
HOTSPOT -
Hot Area:
U
R
U
G
SS
PA
AM
Correct Answer:
EX
HOTSPOT -

On which endpoints will File1 and File2 be available within 24 hours of adding the files? To answer, select the appropriate options in the answer
area.
Hot Area:
U
R
U
G
SS
PA
AM
Correct Answer:
EX
File1: Endpoint3 only -

Cloud Tiering: A switch to enable or disable cloud tiering. When enabled, cloud tiering will tier files to your Azure file shares. This converts on-
premises file shares into a cache, rather than a complete copy of the dataset, to help you manage space efficiency on your server. With cloud
tiering, infrequently used or accessed files can be tiered to Azure Files.
Reference:
HOTSPOT -
U
R
U
G
SS
PA

Hot Area:
AM
EX
Correct Answer:
Box 1: never -
The 10.2.9.0/24 subnet is not whitelisted.
Box 2: never -
After you configure firewall and virtual network settings for your storage account, select Allow trusted Microsoft services to access this storage
account as an exception to enable Azure Backup service to access the network restricted storage account.
U
R
U
G
SS
PA
AM
EX
Reference:
https://docs.microsoft.com/en-us/azure/storage/files/storage-how-to-use-files-windows https://azure.microsoft.com/en-us/blog/azure-
backup-now-supports-storage-accounts-secured-with-azure-storage-firewalls-and-virtual-networks/
HOTSPOT -
You have a sync group named Sync1 that has a cloud endpoint. The cloud endpoint includes a file named File1.txt.
Your on-premises network contains servers that run Windows Server 2016. The servers are configured as shown in the following table.
You add Share1 as an endpoint for Sync1. One hour later, you add Share2 as an endpoint for Sync1.
Hot Area:
U
R
U
G
Correct Answer:
SS
PA
AM
EX
Box 1: Yes -
If you add an Azure file share that has an existing set of files as a cloud endpoint to a sync group, the existing files are merged with any other
files that are already on other endpoints in the sync group.
Box 2: No -
Box 3: Yes -
Reference:
You need to identify which storage account can be converted to zone-redundant storage (ZRS) replication by requesting a live migration from
Azure support.
A. storage1
B. storage2
U
C. storage3
R
D. storage4
Correct Answer: B
U
G
ZRS currently supports standard general-purpose v2, FileStorage and BlockBlobStorage storage account types.
Incorrect Answers:
SS
A, not C: Live migration is supported only for storage accounts that use LRS replication. If your account uses GRS or RA-GRS, then you need to
first change your account's replication type to LRS before proceeding. This intermediary step removes the secondary endpoint provided by
GRS/RA-GRS.
PA
Also, only standard storage account types support live migration. Premium storage accounts must be migrated manually.
D: ZRS currently supports standard general-purpose v2, FileStorage and BlockBlobStorage storage account types.
Reference:
AM
EX
You plan to upload the disk files of a virtual machine to account1 from your on-premises network. The on-premises network uses a public IP
address space of
131.107.1.0/24.
You plan to use the disk files to provision an Azure virtual machine named VM1. VM1 will be attached to a virtual network named VNet1. VNet1
uses an IP address space of 192.168.0.0/24.
✑ Ensure that you can upload the disk files to account1.
✑ Ensure that you can attach the disks to VM1.
✑ Prevent all other access to account1.
B. From the Firewalls and virtual networks blade of account1, select Allow trusted Microsoft services to access this storage account.
C. From the Firewalls and virtual networks blade of account1, add the 131.107.1.0/24 IP address range.
U
R
Correct Answer: AE
U
A: By default, storage accounts accept connections from clients on any network. To limit access to selected networks, you must first change
G
the default action.
SS
Azure portal -
PA
3. To deny access by default, choose to allow access from 'Selected networks'. To allow traffic from all networks, choose to allow access from
'All networks'.
AM

By enabling a Service Endpoint for Azure Storage within the Virtual Network, traffic is ensured an optimal route to the Azure Storage service.
EX
The identities of the virtual network and the subnet are also transmitted with each request.
Reference:
DRAG DROP -
Select and Place:
U
R
U
G
SS
PA
AM
Correct Answer:
EX

The Azure File Sync agent is a downloadable package that enables Windows Server to be synced with an Azure file share
Registering your Windows Server with a Storage Sync Service establishes a trust relationship between your server (or cluster) and the Storage
Sync Service.
Step 3: Add a server endpoint -

A sync group defines the sync topology for a set of files. Endpoints within a sync group are kept in sync with each other. A sync group must
contain one cloud endpoint, which represents an Azure file share and one or more server endpoints. A server endpoint represents a path on
registered server.
Reference:
HOTSPOT -
✑ Replicates synchronously.
✑ Remains available if a single data center in the region fails.
How should you configure the storage account? To answer, select the appropriate options in the answer area.
Hot Area:
U
R
U
G
SS
PA
AM
EX
Correct Answer:

Zone-redundant storage (ZRS) replicates your data synchronously across three storage clusters in a single region.
LRS would not remain available if a data center in the region fails
GRS and RA GRS use asynchronous replication.
Reference:
https://docs.microsoft.com/en-us/azure/storage/common/storage-redundancy https://docs.microsoft.com/en-
us/azure/storage/common/storage-redundancy-zrs
Which two files should you create before you prepare the drives for the import job? Each correct answer presents part of the solution.
B. a dataset CSV file
C. a JSON configuration file
E. a driveset CSV file
Correct Answer: BE
B: Modify the dataset.csv file in the root folder where the tool resides. Depending on whether you want to import a file or folder or both, add
entries in the dataset.csv file
Reference:
U
R
U
G
SS
PA
AM
EX
You have a Recovery Service vault that you use to test backups. The test backups contain two protected virtual machines.
A. From the Recovery Service vault, delete the backup data.
B. Modify the disaster recovery properties of each virtual machine.
C. Modify the locks of each virtual machine.
D. From the Recovery Service vault, stop the backup of each backup item.
Correct Answer: D
You can't delete a Recovery Services vault if it is registered to a server and holds backup data. If you try to delete a vault, but can't, the vault is
still configured to receive backup data.
In the vault dashboard menu, scroll down to the Protected Items section, and click Backup Items. In this menu, you can stop and delete Azure
File Servers, SQL
Servers in Azure VM, and Azure virtual machines.
U
R
U
G
SS
PA
AM
Reference:
EX
HOTSPOT -
You have an Azure subscription named Subscription1 that contains the resources shown in the following table.
Which resources can be backed up to Vault1 and Vault2? To answer, select the appropriate options in the answer area.
Hot Area:
U
R
U
G
SS
PA
AM
EX
Correct Answer:
Box 1: VM1 only -

Note: To create a vault to protect virtual machines, the vault must be in the same region as the virtual machines.
Box 2: Share1 only.
Note: After you select Backup, the Backup pane opens and prompts you to select a storage account from a list of discovered supported storage
accounts. They're either associated with this vault or present in the same region as the vault, but not yet associated to any Recovery Services
vault.
Reference:
https://docs.microsoft.com/bs-cyrl-ba/azure/backup/backup-create-rs-vault https://docs.microsoft.com/en-us/azure/backup/backup-afs

U
R
A. a virtual machine
B. an Azure Cosmos DB database
C. Azure File Storage U

G
SS
Correct Answer: C
Azure Import/Export service is used to securely import large amounts of data to Azure Blob storage and Azure Files by shipping disk drives to
PA
an Azure datacenter.
Note:
AM
There are several versions of this question in the exam. The question has two correct answers:
1. Azure File Storage
2. Azure Blob Storage
EX
The question can have other incorrect answer options, including the following:
✑ Azure Data Lake Store
✑ Azure SQL Database
✑ Azure Data Factory
Reference:
HOTSPOT -
U
R
U
G
SS
PA
AM
EX

Hot Area:
Correct Answer:
Box 1: 3 -
Locally Redundant Storage (LRS) provides highly durable and available storage within a single location (sub region). We maintain an equivalent
of 3 copies
(replicas) of your data within the primary location as described in our SOSP paper; this ensures that we can recover from common failures
(disk, node, rack) without impacting your storage account‫ג‬€™s availability and durability.
Box 2: Access tier -
U
Note: Azure storage offers different access tiers, which allow you to store blob object data in the most cost-effective manner. The available
R
access tiers include:
Hot - Optimized for storing data that is accessed frequently.
U
Cool - Optimized for storing data that is infrequently accessed and stored for at least 30 days.
G
Archive - Optimized for storing data that is rarely accessed and stored for at least 180 days with flexible latency requirements (on the order of
hours).
SS
Reference:
https://azure.microsoft.com/en-us/blog/data-series-introducing-locally-redundant-storage-for-windows-azure-storage/
PA
AM
EX

Which storage services should you identify?
D. file only
Correct Answer: B
AzCopy is a command-line utility that you can use to copy blobs or files to or from a storage account.
Incorrect Answers:
U
Reference:
R
U
G
SS
PA
AM
EX
HOTSPOT -
You have an Azure Storage account named storage1 that uses Azure Blob storage and Azure File storage.
Which authentication method should you use for each type of storage? To answer, select the appropriate options in the answer area.
Hot Area:
U
R
Correct Answer:
U
G
SS
PA
AM
EX
You can provide authorization credentials by using Azure Active Directory (AD), or by using a Shared Access Signature (SAS) token.
Box 1:
Both Azure Active Directory (AD) and Shared Access Signature (SAS) token are supported for Blob storage.
Box 2:
Reference:

You plan to create an Azure container instance named container1 that will use a Docker image named Image1. Image1 contains a Microsoft SQL
Server instance that requires persistent storage.
A. Azure Files
Correct Answer: D
U
R
You plan to implement an Azure Availability Set for App1. The solution must ensure that App1 is available during planned maintenance of the
hardware hosting
VM1 and VM2.
U
G
SS

PA
C. one fault domain

AM
Correct Answer: D
Microsoft updates, which Microsoft refers to as planned maintenance events, sometimes require that VMs be rebooted to complete the update.
To reduce the impact on VMs, the Azure fabric is divided into update domains to ensure that not all VMs are rebooted at the same time.
EX
Incorrect Answers:
A: An update domain is a group of VMs and underlying physical hardware that can be rebooted at the same time.
B, C: A fault domain shares common storage as well as a common power source and network switch. It is used to protect against unplanned
system failure.
References:

A. an Azure Cosmos DB database
C. Azure Data Lake Store
Correct Answer: B
Azure Import/Export service is used to securely import large amounts of data to Azure Blob storage and Azure Files by shipping disk drives to
an Azure datacenter.
Note:
U
R
✑ a virtual machine
✑ Azure SQL Database
✑ Azure Data Factory
U
G
Reference:
SS
PA
AM
EX
DRAG DROP -
You have an on-premises server named Server1 that runs Windows Server 2016.
You plan to set up Azure File Sync between Server1 and the Azure file share.
You need to prepare the subscription for the planned Azure File Sync.
Which two actions should you perform in the Azure subscription? To answer, drag the appropriate actions to the correct targets. Each action may
be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
Select and Place:
U
R
U
G
SS
PA
Correct Answer:
AM
EX
First action: Create a Storage Sync Service

The deployment of Azure File Sync starts with placing a Storage Sync Service resource into a resource group of your selected subscription.
Second action: Install the Azure File Sync agent
The Azure File Sync agent is a downloadable package that enables Windows Server to be synced with an Azure file share.
Reference:
HOTSPOT -
You have an Azure subscription that contains the file shares shown in the following table.
You have the on-premises file shares shown in the following table.
You create an Azure file sync group named Sync1 and perform the following actions:
✑ Add share1 as the cloud endpoint for Sync1.
✑ Add data1 as a server endpoint for Sync1.
✑ Register Server1 and Server2 to Sync1.
U
Hot Area:
R
U
G
SS
PA
AM
Correct Answer:
EX
Box 1: No -
A sync group must contain one cloud endpoint, which represents an Azure file share and one or more server endpoints.
Box 2: Yes -
Data2 is located on Server2 which is registered to Sync1.
Box 3: No -
Data3 is located on Server3 which is not registered to Sync1.
Reference:
https://docs.microsoft.com/en-us/azure/storage/files/storage-sync-files-deployment-guide?tabs=azure-portal%2Cproactive-portal#create-a-
sync-group-and-a- cloud-endpoint
EX
AM
PA
SS
G
U
R
U
HOTSPOT -
You have an Azure subscription named Subscription1 that contains the resources shown in the following table:

Which storage accounts and which Log Analytics workspaces can you use for the Azure Backup reports of Vault1? To answer, select the
Hot Area:
U
R
U
G
SS
PA
AM
EX
Correct Answer:
Box 1: storage1, storage2, and storage3

The location and subscription where this Log Analytics workspace can be created is independent of the location and subscription where your
vaults exist.
Box 2: Analytics3 -
Reference:
HOTSPOT -
You have an Azure subscription that contains the storage accounts shown in the following exhibit.
U
Hot Area:
R
U
G
SS
PA
AM
EX
Correct Answer:
Box 1: contoso104 only -

Premium file shares are hosted in a special purpose storage account kind, called a FileStorage account.
Box 2: contoso101, contoso102, and contos103 only
Reference:
https://docs.microsoft.com/en-us/azure/storage/files/storage-how-to-create-premium-fileshare?tabs=azure-portal
HOTSPOT -
U
R
U
G
SS
PA
AM

EX

Hot Area:
Correct Answer:
Box 1: Will have no access -

Reference:
https://docs.microsoft.com/en-us/azure/storage/common/storage-dotnet-shared-access-signature-part-1 https://docs.microsoft.com/en-
U
us/azure/vs-azure-tools-storage-manage-with-storage-explorer?tabs=windows
R
U
G
SS

PA
You have two Azure virtual machines named VM1 and VM2. You have two Recovery Services vaults named RSV1 and RSV2.
VM2 is backed up to RSV1.
You need to back up VM2 to RSV2.
AM
A. From the RSV1 blade, click Backup items and stop the VM2 backup
EX
B. From the RSV2 blade, click Backup. From the Backup blade, select the backup for the virtual machine, and then click Backup
C. From the VM2 blade, click Disaster recovery, click Replication settings, and then select RSV2 as the Recovery Services vault
D. From the RSV1 blade, click Backup Jobs and export the VM2 job
Correct Answer: C
Reference:
You have a general-purpose v1 Azure Storage account named storage1 that uses locally-redundant storage (LRS).
You need to ensure that the data in the storage account is protected if a zone fails. The solution must minimize costs and administrative effort.
A. Create a new storage account.
B. Configure object replication rules.
C. Upgrade the account to general-purpose v2.
D. Modify the Replication setting of storage1.
Correct Answer: C
Reference:
U
R
U
G
SS
You plan to manage the data stored in the accounts by using lifecycle management rules.
PA
To which storage accounts can you apply lifecycle management rules?
A. storage1 only
AM
B. storage1 and storage2 only
C. storage3 and storage4 only
D. storage1, storage2, and storage3 only

EX
E. storage1, storage2, storage3, and storage4
Correct Answer: D
Reference:
https://docs.microsoft.com/en-us/azure/storage/blobs/storage-lifecycle-management-concepts?tabs=azure-portal
You create an Azure Storage account named contosostorage.

You plan to create a file share named data.
Users need to map a drive to the data file share from home computers that run Windows 10.
Which outbound port should you open between the home computers and the data file share?
A. 80
B. 443
C. 445
D. 3389
Correct Answer: C
Server Message Block (SMB) is used to connect to an Azure file share over the internet. The SMB protocol requires TCP port 445 to be open.
Incorrect Answers:
A: Port 80 is required for HTTP to a web server
B: Port 443 is required for HTTPS to a web server
D: Port 3389443 is required for Remote desktop protocol (RDP) connections
Reference:
U
R
U
G
SS
Question #1 Topic 4
PA
AM
You need to create an alert in Azure when more than two error events are logged to the System event log on VM1 within an hour.
Solution: You create an Azure Log Analytics workspace and configure the data settings. You add the Microsoft Monitoring Agent VM extension to
EX
VM1. You create an alert in Azure Monitor and specify the Log Analytics workspace as the source.
A. Yes
B. No
Correct Answer: B
You must install the Microsoft Monitoring Agent on VM1, and not the Microsoft Monitoring Agent VM extension.
Reference:
Question #2 Topic 4
Solution: You create an Azure Log Analytics workspace and configure the data settings. You install the Microsoft Monitoring Agent on VM1. You
create an alert in
Azure Monitor and specify the Log Analytics workspace as the source.
A. Yes
B. No
Correct Answer: A
Alerts in Azure Monitor can identify important information in your Log Analytics repository. They are created by alert rules that automatically
run log searches at regular intervals, and if results of the log search match particular criteria, then an alert record is created and it can be
configured to perform an automated response.
U
The Log Analytics agent collects monitoring data from the guest operating system and workloads of virtual machines in Azure, other cloud
providers, and on- premises. It collects data into a Log Analytics workspace.
R
Reference:
U
https://docs.microsoft.com/en-us/azure/azure-monitor/learn/tutorial-response https://docs.microsoft.com/en-us/azure/azure-
monitor/platform/agents-overview
G
SS
PA
AM
EX
Question #3 Topic 4
All virtual machines run Windows Server 2016.

On VM1, you back up a folder named Folder1 as shown in the following exhibit.
U
R
U
G
You plan to restore the backup to a different virtual machine.
You need to restore the backup to VM2.
SS
A. From VM1, install the Windows Server Backup feature.

PA
B. From VM2, install the Microsoft Azure Recovery Services Agent.
C. From VM1, install the Microsoft Azure Recovery Services Agent.

AM
D. From VM2, install the Windows Server Backup feature.
Correct Answer: B
EX
Reference:
https://docs.microsoft.com/en-us/azure/backup/backup-azure-restore-windows-server
Question #4 Topic 4
HOTSPOT -
You need to use an Azure Resource Manager (ARM) template to create a virtual machine that will have multiple data disks.
How should you complete the template? To answer, select the appropriate options in the answer area.
Hot Area:
U
R
U
G
SS
PA
AM
EX
Correct Answer:
Question #5 Topic 4
U
R
U
G
SS
PA
AM
EX
A. Yes
B. No
Correct Answer: A
The virtual machine you attach a network interface to and the virtual network you connect it to must exist in the same location, here West US,
also referred to as a region.
Reference:
Question #6 Topic 4
A. Yes
U
B. No
R
Correct Answer: B
U
G
Reference:
SS
PA
AM
EX
Question #7 Topic 4
A. Yes
U
B. No
R
Correct Answer: A
U
G
Reference:
SS
PA
Question #8 Topic 4
AM
EX
You deploy an Azure Kubernetes Service (AKS) cluster named AKS1.
You need to deploy a YAML file to AKS1.
Solution: From Azure CLI, you run az aks.
A. Yes
B. No
Correct Answer: B
Reference:
Question #9 Topic 4
Solution: From Azure CLI, you run the kubectl client.
A. Yes
B. No
Correct Answer: A
Reference:
U
R
U
G
SS

Solution: From Azure CLI, you run azcopy.
PA
A. Yes
AM
B. No
Correct Answer: B
EX
Reference:
Solution: You create an Azure storage account and configure shared access signatures (SASs). You install the Microsoft Monitoring Agent on
VM1. You create an alert in Azure Monitor and specify the storage account as the source.
A. Yes
B. No
Correct Answer: B
Instead: You create an Azure Log Analytics workspace and configure the data settings. You install the Microsoft Monitoring Agent on VM1. You
create an alert in
Reference:
U
R
U
G
SS
PA
AM
EX
HOTSPOT -
You have an Azure subscription named Subscription1. Subscription1 contains the resources in the following table.
An administrator named Admin1 creates an Azure virtual machine named VM1 in RG1. VM1 uses a disk named Disk1 and connects to VNet1.
Admin1 then installs a custom application in VM1.
You need to move the custom application to VNet2. The solution must minimize administrative effort.
Which two actions should you perform? To answer, select the appropriate options in the answer area.
Hot Area:
U
R
U
G
SS
PA
AM
EX
Correct Answer:
We cannot just move a virtual machine between networks. What we need to do is identify the disk used by the VM, delete the VM itself while
retaining the disk, and recreate the VM in the target virtual network and then attach the original disk to it.
Reference:
https://blogs.technet.microsoft.com/canitpro/2014/06/16/step-by-step-move-a-vm-to-a-different-vnet-on-azure/
https://4sysops.com/archives/move-an-azure-vm-to-another-virtual-network-vnet/#migrate-an-azure-vm-between-vnets
You download an Azure Resource Manager template based on an existing virtual machine. The template will be used to deploy 100 virtual
machines.
You need to modify the template to reference an administrative password. You must prevent the password from being stored in plain text.
Correct Answer: A
You can use a template that allows you to deploy a simple Windows VM by retrieving the password that is stored in a Key Vault. Therefore, the
password is never put in plain text in the template parameter file.
Reference:
U
R
U
G
SS
PA
AM
EX
HOTSPOT -
Hot Area:
U
R
U
G
SS
PA
AM
EX
Correct Answer:
Box 1: ASP1 ASP3 -

Box 2: ASP1 -
Reference:
https://docs.microsoft.com/en-us/azure/app-service/quickstart-dotnetcore?pivots=platform-linux https://docs.microsoft.com/en-
us/azure/app-service/app-service-plan-manage#
EX
AM
PA
SS
G
U
R
U
HOTSPOT -
You create a virtual machine scale set named Scale1. Scale1 is configured as shown in the following exhibit.
U
R
U
G
SS
PA
AM

Hot Area:
EX
Correct Answer:
Box 1: 6 virtual machines -

The Autoscale scale out rule increases the number of VMs by 2 if the CPU threshold is 80% or higher. The initial instance count is 4 and rises to
6 when the 2 extra instances of VMs are added.
U
Box 2: 2 virtual machnes -
R
The Autoscale scale in rule decreases the number of VMs by 4 if the CPU threshold is 30% or lower. The initial instance count is 4 and thus
cannot be reduced to
U
0 as the minimum instances is set to 2. Instances are only added when the CPU threshold reaches 80%.
Reference:
G
https://docs.microsoft.com/en-us/azure/azure-monitor/platform/autoscale-overview https://docs.microsoft.com/en-us/azure/azure-
Qm
ueosntiitoonr/#p1la6tform/autoscale-best-practices https://docs.microsoft.com/en-us/azure/azure-monitor/platform/autoscale-common-scale-patTtoeprnics 4
SS
You plan to automate the deployment of a virtual machine scale set that uses the Windows Server 2016 Datacenter image.
PA
You need to ensure that when the scale set virtual machines are provisioned, they have web server components installed.
AM

EX
E. Create a new virtual machine scale set in the Azure portal
Correct Answer: DE
Virtual Machine Scale Sets can be used with the Azure Desired State Configuration (DSC) extension handler. Virtual machine scale sets provide
a way to deploy and manage large numbers of virtual machines, and can elastically scale in and out in response to load. DSC is used to
configure the VMs as they come online so they are running the production software.
Reference:
HOTSPOT -
You have an Azure Kubernetes Service (AKS) cluster named AKS1 and a computer named Computer1 that runs Windows 10. Computer1 that has
the Azure CLI installed.
Hot Area:
U
R
Correct Answer: U
G
SS
PA
To install kubectl locally, use the az aks install-cli command: az aks install-cli
Reference:
AM
EX
DRAG DROP -
You need to use Azure Automation State Configuration to manage the ongoing consistency of the virtual machine configurations.
NOTE: More than one order of answer choices is correct. You will receive credit for any of the correct orders you select.
Select and Place:
U
R
U
G
SS
Correct Answer:
PA
AM

EX

Step 2: Compile a configuration into a node configuration.
A DSC configuration defining that state must be compiled into one or more node configurations (MOF document), and placed on the Automation
DSC Pull Server.
Then: Check the compliance status of the node
Each time Azure Automation State Configuration performs a consistency check on a managed node, the node sends a status report back to the
pull server. You can view these reports on the page for that node.
On the blade for an individual report, you can see the following status information for the corresponding consistency check:
The report status ‫ג‬€" whether the node is "Compliant", the configuration "Failed", or the node is "Not Compliant"
Reference:
You have an Azure Resource Manager template named Template1 that is used to deploy an Azure virtual machine.

U
What should you do?
R
A. Modify the location in the resources section to westus

U
G
SS
Correct Answer: A
PA
AM
EX
Correct Answer: A
The app must be running in the Standard, Premium, or Isolated tier in order for you to enable multiple deployment slots.
If the app isn't already in the Standard, Premium, or Isolated tier, you receive a message that indicates the supported tiers for enabling staged
publishing. At this point, you have the option to select Upgrade and go to the Scale tab of your app before continuing.
Scale up: Get more CPU, memory, disk space, and extra features like dedicated virtual machines (VMs), custom domains and certificates,
staging slots, autoscaling, and more.
Incorrect:
U
Scale out: Increase the number of VM instances that run your app. You can scale out to as many as 30 instances
R
Reference:
https://docs.microsoft.com/en-us/azure/app-service/deploy-staging-slots https://docs.microsoft.com/en-us/azure/app-service/manage-scale-
up
U
G
SS

PA
AM
You need to ensure that App1 always runs on at least eight virtual machines during planned Azure maintenance.
EX
Correct Answer: C
An update domain is a logical group of underlying hardware that can undergo maintenance or be rebooted at the same time. As you create VMs
within an availability set, the Azure platform automatically distributes your VMs across these update domains. This approach ensures that at
least one instance of your application always remains running as the Azure platform undergoes periodic maintenance.
Reference:
Solution: You create an event subscription on VM1. You create an alert in Azure Monitor and specify VM1 as the source
A. Yes
B. No
Correct Answer: B
Instead: You create an Azure Log Analytics workspace and configure the data settings. You install the Microsoft Monitoring Agent on VM1. You
create an alert in
Reference:
U
R
U
G
SS
PA
You have an Azure virtual machine named VM1. VM1 was deployed by using a custom Azure Resource Manager template named ARM1.json.
AM
EX
A. Yes
B. No
Correct Answer: B
Reference:
A. Yes
B. No
Correct Answer: A
When you redeploy a VM, it moves the VM to a new node within the Azure infrastructure and then powers it back on, retaining all your
configuration options and associated resources.
References:
U
R
U
G
SS
PA

AM
A. Yes
B. No
EX
Correct Answer: B
Reference:
You have an Azure subscription that contains a web app named webapp1.
You need to add a custom domain named www.contoso.com to webapp1.
A. Create a DNS record
B. Add a connection string
C. Upload a certificate.
D. Stop webapp1.
Correct Answer: A
You can use either a CNAME record or an A record to map a custom DNS name to App Service.
Reference:
https://docs.microsoft.com/en-us/Azure/app-service/app-service-web-tutorial-custom-domain
U
R
U
G
SS
PA
AM

EX
A. Yes
B. No
Correct Answer: B
Instead you should delete VM1. You recreate VM1, and then you add the network interface for VM1.
Note: When you create an Azure virtual machine (VM), you must create a virtual network (VNet) or use an existing VNet. You can change the
subnet a VM is connected to after it's created, but you cannot change the VNet.
Reference:

Solution: You delete VM1. You recreate VM1, and then you create a new network interface for VM1 and connect it to VNET2.
U
A. Yes
R
B. No
Correct Answer: A
U
G
SS
Reference:
PA
AM
EX

U
A. Yes
R
B. No
Correct Answer: B
U
G
SS
Reference:
PA
AM
EX
HOTSPOT -
You have an Azure subscription named Subscription1 that contains the quotas shown in the following table.
You deploy virtual machines to Subscription1 as shown in the following table.
U
R
Hot Area:
U
G
SS
PA
AM
EX
Correct Answer:
The total regional vCPUs is 20 so that means a maximum total of 20 vCPUs across all the different VM sizes. The deallocated VM with 16
vCPUs counts towards the total. VM20 and VM1 are using 18 of the maximum 20 vCPUs leaving only two vCPUs available.
Reference:
EX
AM
PA
SS
G
U
R
U
HOTSPOT -
You have an Azure subscription that contains an Azure Availability Set named WEBPROD-AS-USE2 as shown in the following exhibit.
U
R
U
G
SS
Hot Area:
PA
AM
EX
Correct Answer:
Box 1: 2 -
There are 10 update domains. The 14 VMs are shared across the 10 update domains so four update domains will have two VMs and six update
domains will have one VM. Only one update domain is rebooted at a time. Therefore, a maximum of two VMs will be offiine.
Box 2: 7 -
There are 2 fault domains. The 14 VMs are shared across the 2 fault domains, so 7 VMs in each fault domain. A rack failure will affect one fault
U
domain so 7 VMs will be offiine.
Reference:
R
U
G
SS
You deploy an Azure Kubernetes Service (AKS) cluster named Cluster1 that uses the IP addresses shown in the following table.
PA
AM
EX
A. 131.107.2.1
B. 10.0.10.11
C. 172.17.7.1
D. 192.168.10.2
Correct Answer: A
You need to identify what to deploy before you deploy Template1. The solution must minimize Azure costs.
Correct Answer: B
Reference:
U
R
U
G
SS
PA
AM
EX
HOTSPOT -
You plan to deploy an Azure container instance by using the following Azure Resource Manager template.
U
R
U
G
SS
PA
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the template.
AM
Hot Area:
EX
Correct Answer:
You have an Azure subscription that contains a virtual machine named VM1. VM1 hosts a line-of-business application that is available 24 hours a
day. VM1 has one network interface and one managed disk. VM1 uses the D4s v3 size.
✑ Change the size to D8s v3.
✑ Add a 500-GB managed disk.
✑ Add the Puppet Agent extension.
✑ Enable Desired State Configuration Management.
U
R

U
G
SS
Correct Answer: C
Reference:
PA
AM
EX
A. Swap the slots
Correct Answer: AD
✑ Authorization
✑ Automation
✑ Resources
✑ Compute
✑ KeyVault
✑ Network
✑ Storage
✑ Billing
✑ Web
Subscription1 contains an Azure virtual machine named VM1 that has the following configurations:
✑ Private IP address: 10.0.0.4 (dynamic)
✑ Network security group (NSG): NSG1
✑ Public IP address: None
✑ Availability set: AVSet
✑ Subnet: 10.0.0.0/24
U
Managed disks: No -
R
✑ Location: East US
U
G
SS

PA

AM

EX
Correct Answer: AEF

You can log network traffic that flows through an NSG with Network Watcher's NSG flow log capability.
✑ In the Azure portal, enable Network Watcher
✑ Register Insights provider. NSG flow logging requires the Microsoft.Insights provider.
✑ Enable NSG flow log. NSG flow log data is written to an Azure Storage account, Subscription1 has storage.
Reference:
You need to deploy an Azure virtual machine scale set that contains five instances as quickly as possible.
What should you do?
Correct Answer: D
Reference:
U
R
U
G
SS
PA
A. 1
B. 2
AM
C. 3
D. 4
EX
Correct Answer: A
HOTSPOT -
You have a pay-as-you-go Azure subscription that contains the virtual machines shown in the following table.
U
R
U
G
SS
PA
AM
EX

Hot Area:
Correct Answer:

Budget alerts for Resource Group RG1, which include VM1, but not VM2.VM1 consumes 20 Euro/day. The 50%, 500 Euro limit, will be reached in
25 days, and an email will be sent.
The 70% and 100% alert conditions will not be reached within a month, and they don't trigger email actions anyway.
U
Credit alerts: Credit alerts are generated automatically at 90% and at 100% of your Azure credit balance. Whenever an alert is generated, it's
reflected in cost alerts and in the email sent to the account owners. 90% and 100% will not be reached though.
R
Reference:
https://docs.microsoft.com/en-us/azure/cost-management-billing/costs/cost-mgt-alerts-monitor-usage-spending
U
G
SS
PA
AM
EX
You have an Azure subscription named Subscription1. Subscription1 contains a resource group named RG1. RG1 contains resources that were
deployed by using templates.
Solution: From the Subscriptions blade, you select the subscription, and then click Programmatic deployment.
A. Yes
B. No
Correct Answer: B
Reference:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/template-tutorial-create-first-template?tabs=azure-powershell
U
R
U
G
SS
PA
AM

EX
A. Yes
B. No
Correct Answer: B
Reference:
You have an Azure Active Directory (Azure AD) tenant named adatum.com that contains the users shown in the following table.

✑ Users may join devices to Azure AD is set to User1.
✑ Additional local administrators on Azure AD joined devices is set to None.
You deploy Windows 10 to a computer named Computer1. User1 joins Computer1 to adatum.com.
A. User1 only
B. User2 only
D. User1, User2, and User3 only
U
E. User1, User2, User3, and User4
R
Correct Answer: C
U
Users may join devices to Azure AD - This setting enables you to select the users who can register their devices as Azure AD joined devices.
The default is All.
G
Additional local administrators on Azure AD joined devices - You can select the users that are granted local administrator rights on a device.
SS
Users added here are added to the Device Administrators role in Azure AD. Global administrators, here User2, in Azure AD and device owners
are granted local administrator rights by default.
Reference:
PA
AM
EX
HOTSPOT -
Hot Area:
U
R
U
G
SS
PA
Correct Answer:
AM
EX
Box 1: No -
RG2 is read only. ReadOnly means authorized users can read a resource, but they cannot delete or update the resource.
Box 2: Yes -
Box 3: Yes -
Note:
App Service resources are region-specific and cannot be moved directly across regions. You can move the App Service resource by creating a
copy of your existing App Service resource in the target region, then move your content over to the new app. You can then delete the source app
and App Service plan.
To make copying your app easier, you can clone an individual App Service app into an App Service plan in another region.
Reference:
https://docs.microsoft.com/en-us/azure/app-service/manage-move-across-regions https://docs.microsoft.com/en-us/azure/azure-resource-
manager/management/move-limitations/app-service-move-limitations
HOTSPOT -
✑ Name: RG1
✑ Region: West US
✑ Tag: ‫ג‬€tag1‫ ג‬:€‫ג‬€value1‫ג‬€
✑ Exclusions: None
✑ Policy definition: Append a tag and its value to resources
✑ Assignment name: Policy1
✑ Parameters:
✑ Tag name: tag2
✑ Tag value: value2
✑ Name: storage1
✑ Location: West US
✑ Resource group: RG1
✑ Tags: ‫ג‬€tag3‫ ג‬:€‫ג‬€value3‫ג‬€
U
R
Hot Area:
U
G
SS
PA
AM
EX
Correct Answer:
Box 1: "tag1": "value1" only -

Reference:
HOTSPOT -

U
Hot Area:
R
U
G
SS
PA
AM
EX
Correct Answer:
Box 1: 60 -
Box 2: 12 -
Note: Rate limiting is a suspension of notifications that occurs when too many are sent to a particular phone number, email address or device.
Rate limiting ensures that alerts are manageable and actionable.
✑ SMS: No more than 1 SMS every 5 minutes.
✑ Voice: No more than 1 Voice call every 5 minutes.
✑ Email: No more than 100 emails in an hour.
✑ Other actions are not rate limited.
Reference:
U
R
A. VM1 only U
G
B. VM3 and VMC only
SS
C. VM1, VM2, VM3, VMA, VMB, and VMC
D. VM1, VM3, VMA, and VMC only
E. VM1 and VM3 only

PA
Correct Answer: D
AM
To create a vault to protect virtual machines, the vault must be in the same region as the virtual machines. If you have virtual machines in
several regions, create a
Recovery Services vault in each region.
Reference:
EX

A. the kubectl command
B. the az aks command
C. the Set-AzVm cmdlet
D. the Azure portal
E. the Set-AzAks cmdlet
Correct Answer: AB
A: The following example uses the kubectl autoscale command to autoscale the number of pods in the azure-vote-front deployment. If average
CPU utilization across all pods exceeds 50% of their requested usage, the autoscaler increases the pods up to a maximum of 10 instances. A
minimum of 3 instances is then defined for the deployment: kubectl autoscale deployment azure-vote-front --cpu-percent=50 --min=3 --max=10
B: Use the az aks update command to enable and configure the cluster autoscaler on the node pool for the existing cluster.
U
Reference:
https://docs.microsoft.com/en-us/azure/aks/tutorial-kubernetes-scale https://docs.microsoft.com/en-us/azure/aks/cluster-autoscaler
R
U
G
SS

✑ An Azure Container Registry instance named Registry1
✑ An Azure Kubernetes Service (AKS) cluster named Cluster1
PA

AM
A. Run the docker push command.
B. Create an App Service plan.

EX
C. Run the az acr build command.
D. Run the az aks create command.
Correct Answer: C
Run the az acr build command to build and push the container image. az acr build \
--file Dockerfile .
Reference:

A. Proximity2 only
B. Proximity1, Proximity2, and Proximity3
C. Proximity1 only
D. Proximity1 and Proximity3 only
Correct Answer: A
U
Only Proximity2, which also in RG2, is location in West US
R
Reference:
U
G
SS
PA

AM
EX
Solution: From the Subscriptions blade, you select the subscription, and then click Resource providers.
A. Yes
B. No
Correct Answer: B
A. Yes
B. No
Correct Answer: B
Reference:
U
R
Question #53
U Topic 4
G
SS
PA

AM
A. Yes
EX
B. No
Correct Answer: A
Reference:

A. Azure HDInsight
B. Linux Diagnostic Extension (LAD) 3.0
C. the AzurePerformanceDiagnostics extension
D. Azure Analysis Services
Correct Answer: C
You can use extensions to configure diagnostics on your VMs to collect additional metric data.
The basic host metrics are available, but to see more granular and VM-specific metrics, you need to install the Azure diagnostics extension on
the VM. The Azure diagnostics extension allows additional monitoring and diagnostics data to be retrieved from the VM.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-machines/linux/tutorial-monitoring
U
R
U
G
SS
PA
AM
EX
HOTSPOT -
You have an Azure subscription named Subscription1. Subscription1 contains a virtual machine named VM1.
U
R
Hot Area:
U
G
SS
PA
AM
EX
Correct Answer:
Box 1:
Rule2 blocks ports 50-60, which includes port 53, the DNS port. Internet users can reach to the Web server, since it uses port 80.
Box 2:
Note: Rules are processed in priority order, with lower numbers processed before higher numbers, because lower numbers have higher priority.
Once traffic matches a rule, processing stops. As a result, any rules that exist with lower priorities (higher numbers) that have the same
attributes as rules with higher priorities are not processed.
Reference:
You plan to deploy three Azure virtual machines named VM1, VM2, and VM3. The virtual machines will host a web app named App1.
You need to ensure that at least two virtual machines are available if a single Azure datacenter becomes unavailable.
Correct Answer: C
Use availability zones to protect from datacenter level failures.
Reference:
U
https://docs.microsoft.com/en-us/azure/virtual-machines/windows/manage-availability https://docs.microsoft.com/en-us/azure/virtual-
machines/windows/tutorial-availability-sets
R
Question #57
U Topic 4
G
SS
PA
A. operating system
AM
D. resource group
EX
Correct Answer: B
✑ the Resource Group name and location for the VM
✑ the administrator username and password
✑ an unique DNS name for the public IP
Reference:
You have an Azure subscription that contains an Azure virtual machine named VM1. VM1 runs a financial reporting app named App1 that does not
support multiple active instances.
You need to create a scheduled runbook to increase the processor performance of VM1 at the end of each month.
Correct Answer: E
Reference:
U
R
U
You plan to deploy several Azure virtual machines that will run Windows Server 2019 in a virtual machine scale set by using an Azure Resource
G
Manager template.
SS
A. Deployment Center in Azure App Service

PA
B. A Desired State Configuration (DSC) extension
C. the New-AzConfigurationAssignment cmdlet

AM
D. a Microsoft Intune device configuration profile
Correct Answer: B
EX
Azure virtual machine extensions are small packages that run post-deployment configuration and automation on Azure virtual machines.
In the following example, the Azure CLI is used to deploy a custom script extension to an existing virtual machine, which installs a Nginx
webserver. az vm extension set \
--resource-group myResourceGroup \
--vm-name myVM --name customScript \
--publisher Microsoft.Azure.Extensions \
--settings '{"commandToExecute": "apt-get install -y nginx"}
Note:
1. a Desired State Configuration (DSC) extension
2. Azure Custom Script Extension
✑ the Publish-AzVMDscConfiguration cmdlet
✑ Azure Application Insights
Reference:
https://docs.microsoft.com/en-us/azure/architecture/framework/devops/automation-configuration
HOTSPOT -
You deploy an Azure Kubernetes Service (AKS) cluster that has the network profile shown in the following exhibit.
Hot Area:
U
R
U
G
SS
PA
AM
EX
Correct Answer:
Box 1: 10.244.0.0/16 -
The Pod CIDR.
Note: The --pod-cidr should be a large address space that isn't in use elsewhere in your network environment. This range includes any on-
premises network ranges if you connect, or plan to connect, your Azure virtual networks using Express Route or a Site-to-Site VPN connection.
This address range must be large enough to accommodate the number of nodes that you expect to scale up to. You can't change this address
range once the cluster is deployed if you need more addresses for additional nodes.
Box 2: 10.0.0.0/16 -
The --service-cidr is used to assign internal services in the AKS cluster an IP address.
Reference:
https://docs.microsoft.com/en-us/azure/aks/configure-kubenet
EX
AM
PA
SS
G
U
R
U
HOTSPOT -
You have the App Service plan shown in the following exhibit.
U
R
The scale-in settings for the App Service plan are configured as shown in the following exhibit.
U
G
SS
PA
AM
EX
The scale out rule is configured with the same duration and cool down tile as the scale in rule.
Hot Area:
U
Correct Answer:
R
U
G
SS
PA
AM
EX
Box 1: 5 -
The maximum 5 will kept as the CPU Usage >= 30.
Box 2: 3 -
As soon as the average CPU usage drops below 30%, the count will decrease by 1. After the 5 minute cool-down it will decrease by another 1,
reaching 3.
Reference:
https://docs.microsoft.com/en-us/azure/azure-monitor/learn/tutorial-autoscale-performance-schedule
You have an Azure virtual machine named VM1 that runs Windows Server 2019. The VM was deployed using default drive settings.
✑ Create files on drive C.
✑ Create files on drive D.
✑ Modify the screen saver timeout.
✑ Change the desktop background.
Correct Answer: C
U
R
U
G
SS
PA
AM
EX

You have an on-premises virtual machine named VM1. The settings for VM1 are shown in the exhibit. (Click the Exhibit tab.)
U
R
U
G
SS
PA
AM
You need to ensure that you can use the disks attached to VM1 as a template for Azure virtual machines.
EX
A. the memory
C. the hard drive
D. the processor
Correct Answer: C
Before you upload a Windows virtual machine (VM) from on-premises to Microsoft Azure, you must prepare the virtual hard disk (VHD or
VHDX). Azure supports only generation 1 VMs that are in the VHD file format and have a fixed sized disk. The maximum size allowed for the
VHD is 1,023 GB. You can convert a generation 1 VM from the VHDX file system to VHD and from a dynamically expanding disk to fixed-sized.
Reference:
HOTSPOT -
You have an Azure subscription that contains a virtual machine scale set. The scale set contains four instances that have the following
configurations:
✑ Operating system: Windows Server 2016
✑ Size: Standard_D1_v2
U
R
Hot Area:
U
G
SS
PA
AM
EX
Correct Answer:
The Get-AzVmssVM cmdlet gets the model view and instance view of a Virtual Machine Scale Set (VMSS) virtual machine.
Box 1: 0 -
The enableAutomaticUpdates parameter is set to false. To update existing VMs, you must do a manual upgrade of each existing VM.
U
Box 2: 4 -
R
Enabling automatic OS image upgrades on your scale set helps ease update management by safely and automatically upgrading the OS disk for
all instances in the scale set.
Reference:
U
G
https://docs.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-upgrade-scale-set
https://docs.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-automatic-upgrade
SS
PA
AM
EX
You have an Azure subscription named Subscription1 that is used by several departments at your company. Subscription1 contains the resources
in the following table:
Another administrator deploys a virtual machine named VM1 and an Azure Storage account named storage2 by using a single Azure Resource
Manager template.
A. VM1
B. RG1
C. storage2
D. container1
U
R
Correct Answer: B
U
1. Go to the resource group for your new resource group. Notice that the portal shows the result of the last deployment. Select this link.
G
SS
PA
AM
2. You see a history of deployments for the group. In your case, the portal probably lists only one deployment. Select this deployment.
EX
3. The portal displays a summary of the deployment. The summary includes the status of the deployment and its operations and the values that
you provided for parameters. To see the template that you used for the deployment, select View template.
You have an Azure web app named App1. App1 has the deployment slots shown in the following table:
Reference:
You back up App1.
You swap webapp1-test for webapp1-prod and discover that App1 is experiencing performance issues.
You need to revert to the previous version of App1 as quickly as possible.
What should you do?
U
A. Redeploy App1
R
B. Swap the slots
C. Clone App1
U
G
SS
Correct Answer: B
When you swap deployment slots, Azure swaps the Virtual IP addresses of the source and destination slots, thereby swapping the URLs of the
slots. We can easily revert the deployment by swapping back.
PA
Reference:
AM
EX
HOTSPOT -
You have an Azure subscription named Subscription1. Subscription1 contains two Azure virtual machines VM1 and VM2. VM1 and VM2 run
Windows Server
2016.
VM1 is backed up daily by Azure Backup without using the Azure Backup agent.
To which location can you restore the backup? To answer, select the appropriate options in the answer area.
Hot Area:
U
R
U
G
SS
Correct Answer:
PA
AM
EX
Note: The new VM must be in the same region.

Reference:
You plan to back up an Azure virtual machine named VM1.

You discover that the Backup Pre-Check status displays a status of Warning.
What is a possible cause of the Warning status?
A. VM1 is stopped.
B. VM1 does not have the latest version of the Azure VM Agent (WaAppAgent.exe) installed.
C. VM1 has an unmanaged disk.
D. A Recovery Services vault is unavailable.
U
Correct Answer: B
R
The Warning state indicates one or more issues in VM‫ג‬€™s configuration that might lead to backup failures and provides recommended steps
to ensure successful backups. Not having the latest VM Agent installed, for example, can cause backups to fail intermittently and falls in this
class of issues.
Reference: U
G
https://azure.microsoft.com/en-us/blog/azure-vm-backup-pre-checks/
SS

PA
AM
EX

A. Yes
B. No
Correct Answer: B
Reference:
HOTSPOT -
You plan to use Azure Resource Manager templates to deploy 50 Azure virtual machines that will be part of the same availability set.
You need to ensure that as many virtual machines as possible are available if the fabric fails or during servicing.
How should you configure the template? To answer, select the appropriate options in the answer area.
Hot Area:
U
R
U
G
SS
PA
Correct Answer:
AM
EX
Box 1: 2 -
Use two fault domains.
2 or 3 is max, depending on which region you are in.
Box 2: 20 -
Use 20 for platformUpdateDomainCount
Increasing the update domain (platformUpdateDomainCount) helps with capacity and availability planning when the platform reboots nodes. A
higher number for the pool (20 is max) means that fewer of their nodes in any given availability set would be rebooted at once.
Reference:
https://www.itprotoday.com/microsoft-azure/check-if-azure-region-supports-2-or-3-fault-domains-managed-disks
https://github.com/Azure/acs-engine/issues/1030
Solution: You create an Azure Log Analytics workspace and configure the Agent configuration settings. You install the Microsoft Monitoring Agent
on VM1. You create an alert in Azure Monitor and specify the Log Analytics workspace as the source.
U
R
A. Yes
B. No
U
G
Correct Answer: A
SS
Alerts in Azure Monitor can identify important information in your Log Analytics repository. They are created by alert rules that automatically
run log searches at regular intervals, and if results of the log search match particular criteria, then an alert record is created and it can be
configured to perform an automated response.
PA
The Log Analytics agent collects monitoring data from the guest operating system and workloads of virtual machines in Azure, other cloud
providers, and on- premises. It collects data into a Log Analytics workspace.
References:
AM
https://docs.microsoft.com/en-us/azure/azure-monitor/learn/tutorial-response https://docs.microsoft.com/en-us/azure/azure-
monitor/platform/agents-overview
EX

Question #1 Topic 5
HOTSPOT -
You have an Azure subscription that contains a virtual network named VNet1. VNet1 uses an IP address space of 10.0.0.0/16 and contains the
VPN Gateway and subnets in the following table:

Hot Area:
U
R
U
G
SS
PA
AM
EX
Correct Answer:
Question #2 Topic 5
You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers.
You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines.
B. Floating IP (direct server return) to Disabled
C. a health probe
Correct Answer: D
With Sticky Sessions when a client starts a session on one of your web servers, session stays on that specific server. To configure An Azure
Load-Balancer For
Sticky Sessions set Session persistence to Client IP.
U
R
U
G
SS
PA
AM
EX
Note:
There are several versions of this question in the exam. The question can have other incorrect answer options, including the following:
1. Idle Time-out (minutes) to 20
2. Protocol to UDP
Reference:
Question #3 Topic 5
HOTSPOT -
VM1 and VM2 use public IP addresses. From Windows Server 2019 on VM1 and VM2, you allow inbound Remote Desktop connections.
The subscription contains two network security groups (NSGs) named NSG1 and NSG2. NSG1 uses only the default rules.
✑ Priority: 100
✑ Name: Rule1
✑ Port: 3389
✑ Protocol: TCP
✑ Source: Any
✑ Destination: Any
✑ Action: Allow
U
R
Hot Area:
U
G
SS
PA
AM
EX
Correct Answer:
Question #4 Topic 5
HOTSPOT -
You have Azure virtual machines that have the network configurations shown in the following table:
U
R
Hot Area:
U
G
SS
PA
AM
Correct Answer:
EX
Box 1: Yes -
The inbound security rule for NSG1 allows TCP port 1433 from 10.10.2.0/24 (or Subnet2 where VM2 and VM3 are located) to 10.10.1.0/24 (or
Subnet1 where
VM1 is located) while the inbound security rule for NSG2 blocks TCP port 1433 from 10.10.2.5 (or VM2) to 10.10.1.5 (or VM1). However, the
NSG1 rule has a higher priority (or lower value) than the NSG2 rule.
Box 2: Yes -
No rule explicitly blocks communication from VM1. The default rules, which allow communication, are thus applied.
Box 3: Yes -
No rule explicitly blocks communication between VM2 and VM3 which are both on Subnet2. The default rules, which allow communication, are
thus applied.
Reference:
U
R
U
G
SS
PA
AM
EX
Question #5 Topic 5
HOTSPOT -
VM3 has multiple network adapters, including a network adapter named NIC3. IP forwarding is enabled on NIC3. Routing is enabled on VM3.
U
R
Hot Area: U
G
SS
PA
AM
EX
Correct Answer:

✑ Receive network traffic not destined for one of the IP addresses assigned to any of the IP configurations assigned to the network interface.
✑ Send network traffic with a different source IP address than the one assigned to one of a network interface's IP configurations.
The setting must be enabled for every network interface that is attached to the virtual machine that receives traffic that the virtual machine
needs to forward. A virtual machine can forward traffic whether it has multiple network interfaces or a single network interface attached to it.
Box 1: Yes -
The routing table allows connections from VM3 to VM1 and VM2. And as IP forwarding is enabled on VM3, VM3 can connect to VM1.
Box 2: No -
Box 3: Yes -
The routing table allows connections from VM1 and VM2 to VM3. IP forwarding on VM3 allows VM1 to connect to VM2 via VM3.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview https://www.quora.com/What-is-IP-forwarding
Question #6 Topic 5

✑ A web app named webapp1
✑ A virtual network named VNET1
U
R
Correct Answer: C
U
A Site-to-Site VPN gateway connection can be used to connect your on-premises network to an Azure virtual network over an IPsec/IKE (IKEv1
G
or IKEv2) VPN tunnel.
This type of connection requires a VPN device, a VPN gateway, located on-premises that has an externally facing public IP address assigned to
SS
it.
Incorrect Answers:
B: Application Proxy is a feature of Azure AD that enables users to access on-premises web applications from a remote client.
PA
Reference:
https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-site-to-site-resource-manager-portal
AM
EX
Question #7 Topic 5
You plan to deploy several Azure virtual machines that will run Windows Server 2019 in a virtual machine scale set by using an Azure Resource
Manager template.
A. the Publish-AzVMDscConfiguration cmdlet
Correct Answer: C
Note:
✑ Deployment Center in Azure App Service
U
✑ a Microsoft Intune device configuration profile
R
Reference:
U
G
SS
PA
AM
EX
Question #8 Topic 5
HOTSPOT -

✑ Ensure that communication between the web servers and the business logic tier spreads equally across the virtual machines.
✑ Protect the web servers from SQL injection attacks.
Which Azure resource should you recommend for each requirement? To answer, select the appropriate options in the answer area.
Hot Area:
U
R
U
G
SS
PA
AM
Correct Answer:
EX

Azure Internal Load Balancer (ILB) provides network load balancing between virtual machines that reside inside a cloud service or a virtual
network with a regional scope.
Azure Web Application Firewall (WAF) on Azure Application Gateway provides centralized protection of your web applications from common
exploits and vulnerabilities. Web applications are increasingly targeted by malicious attacks that exploit commonly known vulnerabilities.
Reference:
Question #9 Topic 5
Your company has three offices. The offices are located in Miami, Los Angeles, and New York. Each office contains datacenter.
You have an Azure subscription that contains resources in the East US and West US Azure regions. Each region contains a virtual network. The
virtual networks are peered.
You need to connect the datacenters to the subscription. The solution must minimize network latency between the datacenters.
Correct Answer: C
Reference:
U
R
U
G
SS
PA
AM
EX
HOTSPOT -
You plan to deploy five virtual machines to a virtual network subnet.
Each virtual machine will have a public IP address and a private IP address.
What is the minimum number of network interfaces and network security groups that you require? To answer, select the appropriate options in the
answer area.
Hot Area:
U
R
U
G
SS
PA
Correct Answer:
AM
EX
Box 1: 5 -
A public and a private IP address can be assigned to a single network interface.
Box 2: 1 -
You can associate zero, or one, network security group to each virtual network subnet and network interface in a virtual machine. The same
network security group can be associated to as many subnets and network interfaces as you choose.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface-addresses
LB1 is configured as shown in the following table.
U
R
U
G
You plan to create new inbound NAT rules that meet the following requirements:
SS
✑ Provide Remote Desktop access to VM1 from the internet by using port 3389.
✑ Provide Remote Desktop access to VM2 from the internet by using port 3389.
What should you create on LB1 before you can create the new inbound NAT rules?
PA
A. a frontend IP address
B. a load balancing rule

AM
C. a health probe
D. a backend pool
EX
Correct Answer: A
HOTSPOT -
You have Azure virtual machines that run Windows Server 2019 and are configured as shown in the following table.
You create a private Azure DNS zone named adatum.com. You configure the adatum.com zone to allow auto registration from VNET1.
Which A records will be added to the adatum.com zone for each virtual machine? To answer, select the appropriate options in the answer area.
Hot Area:
U
R
U
G
SS
PA
Correct Answer:
AM
EX
The virtual machines are registered (added) to the private zone as A records pointing to their private IP addresses.
Reference:
https://docs.microsoft.com/en-us/azure/dns/private-dns-overview https://docs.microsoft.com/en-us/azure/dns/private-dns-scenarios
HOTSPOT -
You have an Azure virtual network named VNet1 that connects to your on-premises network by using a site-to-site VPN. VNet1 contains one
subnet named
Sunet1.
Subnet1 is associated to a network security group (NSG) named NSG1. Subnet1 contains a basic internal load balancer named ILB1. ILB1 has
three Azure virtual machines in the backend pool.
You need to collect data about the IP addresses that connects to ILB1. You must be able to run interactive queries from the Azure portal against
the collected data.
Hot Area:
U
R
U
G
SS
PA
AM
Correct Answer:
EX

In the Azure portal you can set up a Log Analytics workspace, which is a unique Log Analytics environment with its own data repository, data
sources, and solutions
Box 2: ILB1 -
Reference:
https://docs.microsoft.com/en-us/azure/log-analytics/log-analytics-quick-create-workspace https://docs.microsoft.com/en-us/azure/load-
balancer/load-balancer-standard-diagnostics
A. VNet2 andVNet3 only
B. VNet2 only
Correct Answer: C
Address spaces must not overlap to enable VNet Peering.
U
Incorrect Answers:
A, B, D: The address space for VNet2 overlaps with VNet1. We therefore cannot establish a peering between VNet2 and VNet1.
R
Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/tutorial-connect-virtual-networks-portal https://docs.microsoft.com/en-
us/azure/virtual-network/virtual-networks-faq#vnet-peering
U
G
SS
PA
AM
EX
You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains four subnets named Gateway, Perimeter, NVA, and
Production.
The NVA subnet contains two network virtual appliances (NVAs) that will perform network traffic inspection between the Perimeter subnet and the
Production subnet.
You need to implement an Azure load balancer for the NVAs. The solution must meet the following requirements:
✑ The NVAs must run in an active-active configuration that uses automatic failover.
✑ The load balancer must load balance traffic to two services on the Production subnet. The services have different IP addresses.
U
Correct Answer: BCF
R
U
G
Incorrect Answers:
SS
Reference:
https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-standard-overview https://docs.microsoft.com/en-us/azure/load-
balancer/load-balancer-multivip-overview
PA
AM
You have an Azure subscription named Subscription1 that contains two Azure virtual networks named VNet1 and VNet2. VNet1 contains a VPN
gateway named
EX
VPNGW1 that uses static routing. There is a site-to-site VPN connection between your on-premises network and VNet1.
On a computer named Client1 that runs Windows 10, you configure a point-to-site VPN connection to VNet1.
You configure virtual network peering between VNet1 and VNet2. You verify that you can connect to VNet2 from the on-premises network. Client1
is unable to connect to VNet2.
What should you do?
Correct Answer: A
Reference:
HOTSPOT -
You have an Azure subscription. The subscription contains virtual machines that run Windows Server 2016 and are configured as shown in the
following table.
You create a public Azure DNS zone named adatum.com and a private Azure DNS zone named contoso.com.
U
R
U
G
SS
PA
AM
Hot Area:
EX
Correct Answer:
Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances
U
R
Correct Answer: D U
G
All Azure resources are created in an Azure region and subscription. A resource can only be created in a virtual network that exists in the same
region and subscription as the resource.
SS
Reference:
PA
AM
EX
DRAG DROP -
You have an Azure subscription that contains two virtual networks named VNet1 and VNet2. Virtual machines connect to the virtual networks.
The virtual networks have the address spaces and the subnets configured as shown in the following table.
You need to add the address space of 10.33.0.0/16 to VNet1. The solution must ensure that the hosts on VNet1 and VNet2 can communicate.
Select and Place:
U
R
U
G
SS
PA
AM
EX
Correct Answer:

You can't add address ranges to, or delete address ranges from a virtual network's address space once a virtual network is peered with another
virtual network.
To add or remove address ranges, delete the peering, add or remove the address ranges, then re-create the peering.
Reference:
U
R
U
G
SS
PA
AM
EX
HOTSPOT -
RG2 contains a public IP address named IP2 that is in the East US location. IP2 is not assigned to a virtual machine.
U
Hot Area:
R
U
G
SS
PA
AM
Correct Answer:
EX
Box 1: Yes -
You can move storage -
Box 2: No -
Box 3: No -
Reference:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/move-support-resources https://docs.microsoft.com/en-
us/azure/virtual-network/move-across-regions-publicip-powershell

You have a virtual network named VNET1 and an Azure virtual machine named VM1 that hosts a MySQL database. VM1 connects to VNET1.
What should you do?
U
R
Correct Answer: D
U
G
SS
PA
AM
EX
U
R
U
G
SS
PA
AM

EX
A. Connect to VM1.
B. Start VM1.
C. Capture a snapshot of VM1.
D. Configure a DNS name for VM1.
Correct Answer: B
The DSC extension for Windows requires that the target virtual machine is able to communicate with Azure.
Reference:
U
R
G
SS
You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers.
PA
A. Floating IP (direct server return) to Disabled

AM
B. Session persistence to None
C. Floating IP (direct server return) to Enabled
D. Session persistence to Client IP

EX
Correct Answer: D
With Sticky Sessions when a client starts a session on one of your web servers, session stays on that specific server. To configure An Azure
Load-Balancer For
Sticky Sessions set Session persistence to Client IP or to Client IP and protocol.
Note:
✑ Client IP and protocol specifies that successive requests from the same client IP address and protocol combination will be handled by the
same virtual machine.
✑ Client IP specifies that successive requests from the same client IP address will be handled by the same virtual machine.
Reference:
✑ A virtual network that has a subnet named Subnet1
✑ Two network security groups (NSGs) named NSG-VM1 and NSG-Subnet1
✑ A virtual machine named VM1 that has the required Windows Server configurations to allow Remote Desktop connections
✑ Priority: 100
✑ Source: Any
✑ Source port range: *
✑ Destination: *
✑ Destination port range: 3389
✑ Protocol: UDP
✑ Action: Allow
VM1 has a public IP address and is connected to Subnet1. NSG-VM1 is associated to the network interface of VM1. NSG-Subnet1 is associated to
Subnet1.
U
Solution: You add an inbound security rule to NSG-Subnet1 that allows connections from the Any source to the *destination for port range 3389
R
and uses the TCP protocol. You remove NSG-VM1 from the network interface of VM1.
U
G
A. Yes
SS
B. No
Correct Answer: B
PA
The default port for RDP is TCP port 3389. A rule to permit RDP traffic must be created automatically when you create your VM.
Note on NSG-Subnet1: Azure routes network traffic between all subnets in a virtual network, by default.
Reference:
AM
https://docs.microsoft.com/en-us/azure/virtual-machines/troubleshooting/troubleshoot-rdp-connection
EX
✑ Priority: 100
✑ Source: Any
✑ Destination: *
Destination port range: 3389 -
✑ Protocol: UDP
✑ Action: Allow
U
Subnet1.
R
U
Solution: You add an inbound security rule to NSG-Subnet1 that allows connections from the internet source to the VirtualNetwork destination for
port range 3389 and uses the UDP protocol.
G
SS
A. Yes
B. No
PA
Correct Answer: B
AM
Reference:
EX
✑ Priority: 100
✑ Source: Any
✑ Destination: *
✑ Destination port range: 3389
✑ Protocol: UDP
✑ Action: Allow
Subnet1.
U
Solution: You add an inbound security rule to NSG-Subnet1 and NSG-VM1 that allows connections from the internet source to the VirtualNetwork
R
destination for port range 3389 and uses the TCP protocol.
U
G
A. Yes
SS
B. No
Correct Answer: A
PA
Reference:
AM
EX
HOTSPOT -
U
R
U
G
SS
PA

Hot Area:
AM
EX
Correct Answer:
Box 1: add an address space -

Your IaaS virtual machines (VMs) and PaaS role instances in a virtual network automatically receive a private IP address from a range that you
specify, based on the address space of the subnet they are connected to. We need to add the 192.168.1.0/24 address space.
Box 2: add a network interface -

Reference:
U
https://docs.microsoft.com/en-us/office365/enterprise/designing-networking-for-microsoft-azure-iaas
R
U
G
SS
PA
AM
EX
You have an Azure subscription that contains a virtual network named VNET1. VNET1 contains the subnets shown in the following table.

✑ Allow web requests from the internet to VM3, VM4, VM5, and VM6.
✑ Allow all connections between VM1 and VM2.
✑ Allow Remote Desktop connections to VM1.
✑ Prevent all other network traffic to VNET1.
A. 1
B. 3
C. 4
D. 12
U
R
Correct Answer: C
U
Note: A network security group (NSG) contains a list of security rules that allow or deny network traffic to resources connected to Azure Virtual
Networks (VNet).
G
NSGs can be associated to subnets, individual VMs (classic), or individual network interfaces (NIC) attached to VMs (Resource Manager).
SS
Reference:
PA

AM
EX
The Not allowed resource types Azure policy that has policy enforcement enabled is assigned to RG1 and uses the following parameters:
A. Remove Microsoft.Compute/virtualMachines from the policy.
B. Create an Azure Resource Manager template
C. Add a subnet to VNET1.
D. Remove Microsoft.Network/virtualNetworks from the policy.
Correct Answer: A
The Not allowed resource types Azure policy prohibits the deployment of specified resource types. You specify an array of the resource types to
block.
Reference:

The company also has two on-premises servers named Server1 and Server2 that run Windows Server 2016. Server1 is configured as a DNS server
that has a primary DNS zone named adatum.com. Adatum.com contains 1,000 DNS records.
✑ The DNS Manager console
✑ Azure PowerShell
✑ Azure CLI 2.0
You need to move the adatum.com zone to an Azure DNS zone in Subscription1. The solution must minimize administrative effort.
A. Azure CLI
B. Azure PowerShell
C. the Azure portal
Correct Answer: B
U
Open an elevated PowerShell window (Administrative mode) and run following command install-script PrivateDnsMigrationScript
R
Step 2: Running the script -
U
G
PrivateDnsMigrationScript.ps1 -
SS
Reference:
PA

AM
You have a public load balancer that balances ports 80 and 443 across three virtual machines named VM1, VM2, and VM3.
EX
A. an inbound NAT rule
B. a new public load balancer for VM3
C. a frontend IP configuration
D. a load balancing rule
Correct Answer: A
Reference:
https://docs.microsoft.com/en-us/azure/load-balancer/tutorial-load-balancer-port-forwarding-portal https://pixelrobots.co.uk/2017/08/azure-
load-balancer-for-rds/
HOTSPOT -
You have an Azure subscription named Subscription1 that contains the virtual networks in the following table.
✑ Name: LB1
✑ SKU: Basic
✑ Type: Internal
✑ Subnet: Subnet12
✑ Virtual network: VNET1
U
R
Hot Area:
U
G
SS
PA
AM
EX
Correct Answer:
Reference:
HOTSPOT -
You have an Azure virtual machine that runs Windows Server 2019 and has the following configurations:
✑ Name: VM1
✑ Location: West US
✑ Connected to: VNET1
✑ Private IP address: 10.1.0.4
✑ Public IP addresses: 52.186.85.63
✑ DNS suffix in Windows Server: Adatum.com
You need to identify which DNS zones you can link to VNET1 and the DNS zones to which VM1 can automatically register.
Hot Area:
U
R
U
G
SS
PA
AM
EX
Correct Answer:
Reference:
DRAG DROP -
In Azure, you have an Azure virtual network named VNet1 that uses an address space of 10.0.0.0/16 VNet1 contains a subnet named Subnet1 that
uses an address space of 10.0.0.0/24.
Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and
NOTE: More than one order of answer choice is correct. You will receive credit for any of the correct orders you select.
Select and Place:
U
R
U
G
SS
PA
Correct Answer:
AM
EX
U
R
U
G
SS
You need to prevent users of VM1 and VM2 from accessing websites on the Internet over TCP port 80.
What should you do?
PA
A. Disassociate the NSG from a network interface
B. Change the Port_80 inbound security rule.

AM
C. Associate the NSG to Subnet1.
D. Change the DenyWebSites outbound security rule.

EX
Correct Answer: C
The NSG has the appropriate rule to block users from accessing the Internet. We just need to associate it with Subnet1.
Reference:
You have two subscriptions named Subscription1 and Subscription2. Each subscription is associated to a different Azure AD tenant.
Subscription1 contains a virtual network named VNet1. VNet1 contains an Azure virtual machine named VM1 and has an IP address space of
10.0.0.0/16.
Subscription2 contains a virtual network named VNet2. VNet2 contains an Azure virtual machine named VM2 and has an IP address space of
10.10.0.0/24.
A. Move VM1 to Subscription2.
B. Move VNet1 to Subscription2.
C. Modify the IP address space of VNet2.
D. Provision virtual network gateways.
Correct Answer: D
The virtual networks can be in the same or different regions, and from the same or different subscriptions. When connecting VNets from
different subscriptions, the subscriptions do not need to be associated with the same Active Directory tenant.
Configuring a VNet-to-VNet connection is a good way to easily connect VNets. Connecting a virtual network to another virtual network using the
U
VNet-to-VNet connection type (VNet2VNet) is similar to creating a Site-to-Site IPsec connection to an on-premises location. Both connectivity
R
types use a VPN gateway to provide a secure tunnel using IPsec/IKE, and both function the same way when communicating.
The local network gateway for each VNet treats the other VNet as a local site. This lets you specify additional address space for the local
network gateway in order to route traffic.
U
G
Reference:
https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-vnet-vnet-resource-manager-portal
SS
PA
AM
EX
You plan to create an Azure virtual machine named VM1 that will be configured as shown in the following exhibit.
U
R
U
G
SS
PA
AM
EX
U
R
U
G
SS
A. Use managed disks
B. OS disk type
PA
C. Availability options
D. Size
AM
E. Image
Correct Answer: AC
EX
A: Your VMs should use managed disks if you want to move them to an Availability Zone by using Site Recovery.
C: When you create a VM for an Availability Zone, Under Settings > High availability, select one of the numbered zones from the Availability zone
dropdown.
Reference:
https://docs.microsoft.com/en-us/azure/site-recovery/move-azure-vms-avset-azone https://docs.microsoft.com/en-us/azure/virtual-
U
machines/windows/create-portal-availability-zone
R
U
G
SS
PA
AM
EX
HOTSPOT -

Which resource group and location should you use to deploy VM1? To answer, select the appropriate options in the answer area.
Hot Area:
U
R
U
G
SS
PA
Correct Answer:
AM
EX
Box 1: RG1, RG2, or RG3 -

The resource group stores metadata about the resources. When you specify a location for the resource group, you're specifying where that
metadata is stored.
Box 2: West US only -

ScaleSetVM ‫ג‬€" Virtual machine instances added to the scale set are based on the scale set configuration model. The virtual machine instance
lifecycle - creation, update, deletion - is managed by the scale set.
VM (virtual machines) ‫ג‬€" Virtual machines created outside of the scale set can be explicitly added to the scaleset.
Reference:
HOTSPOT -
You have an Azure subscription that contains three virtual networks named VNET1, VNET2, and VNET3.
U
R
U
G
SS
PA

AM
EX
How can packets be routed between the virtual networks? To answer, select the appropriate options in the answer area.
Hot Area:
Correct Answer:
Box 1. VNET2 and VNET3 -
Box 2: VNET1 -
Reference:
U
R
U
G
SS
PA
You have a computer named Computer1 that has a point-to-site VPN connection to an Azure virtual network named VNet1. The point-to-site
AM
connection uses a self-signed certificate.

From Azure, you download and install the VPN client configuration package on a computer named Computer2.
You need to ensure that you can establish a point-to-site VPN connection to VNet1 from Computer2.
EX
A. Yes
B. No
Correct Answer: B
Note:
Each client computer that connects to a VNet using Point-to-Site must have a client certificate installed. You generate a client certificate from
the self-signed root certificate, and then export and install the client certificate. If the client certificate is not installed, authentication fails.
Reference:
Solution: You join Computer2 to Azure Active Directory (Azure AD).
A. Yes
B. No
Correct Answer: B
A client computer that connects to a VNet using Point-to-Site must have a client certificate installed.
Reference:
U
R
U
G
SS
You have an Azure subscription that contains 10 virtual networks. The virtual networks are hosted in separate resource groups.
PA
You need to ensure that when an NSG is created, it automatically blocks TCP port 8080 between the virtual networks.
AM
A. Yes
B. No
EX
Correct Answer: B
You have a computer named Computer1 that runs Windows 10. Computer1 is connected to the Internet.
You add a network interface named vm1173 to VM1 as shown in the exhibit. (Click the Exhibit tab.)
U
R
U
From Computer1, you attempt to connect to VM1 by using Remote Desktop, but the connection fails.
G
SS

PA
D. Start VM1
AM
Correct Answer: D
Incorrect Answers:
A: Rules are processed in priority order, with lower numbers processed before higher numbers, because lower numbers have higher priority.
EX
Once traffic matches a rule, processing stops. RDP already has the lowest number and thus the highest priority.
Reference:

U
You need to ensure that all the virtual machines can resolve DNS names by using the DNS service on VM1.
What should you do?
R
B. Add service endpoints on VNET1 U

G
SS
Correct Answer: D
PA
Virtual network peering enables you to seamlessly connect networks in Azure Virtual Network. The virtual networks appear as one for
connectivity purposes. The traffic between virtual machines uses the Microsoft backbone infrastructure.
Incorrect Answers:
AM
B, C: Virtual Network (VNet) service endpoint provides secure and direct connectivity to Azure services over an optimized route over the Azure
backbone network.
Endpoints allow you to secure your critical Azure service resources to only your virtual networks. Service Endpoints enables private IP
EX
addresses in the VNet to reach the endpoint of an Azure service without needing a public IP address on the VNet.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview https://docs.microsoft.com/en-
us/azure/virtual-network/virtual-network-peering-overview
HOTSPOT -
You have an Azure subscription that contains the Azure virtual machines shown in the following table.
You add inbound security rules to a network security group (NSG) named NSG1 as shown in the following table.
U
R
U
G
SS
PA
AM
EX

U
R
U
G
SS
PA
Hot Area:
AM
EX
Correct Answer:
Box 1: No -
Box 2: Yes -
Box 3: No -
Reference:
U
R
U
G
SS
You have the Azure virtual network named VNet1 that contains a subnet named Subnet1. Subnet1 contains three Azure virtual machines. Each
virtual machine has a public IP address.
PA
The virtual machines host several applications that are accessible over port 443 to users on the Internet.
You discover that the virtual machines can be accessed by using the Remote Desktop Protocol (RDP) from the Internet and from the on-premises
AM
network.
You need to prevent RDP access to the virtual machines from the Internet, unless the RDP connection is established from the on-premises
network. The solution must ensure that all the applications can still be accessed by the Internet users.
What should you do?
EX
Correct Answer: B
You can use a site-to-site VPN to connect your on-premises network to an Azure virtual network. Users on your on-premises network connect by
using the RDP or
SSH protocol over the site-to-site VPN connection. You don't have to allow direct RDP or SSH access over the internet.
Reference:

What should you do?
Correct Answer: A
U
References:
R
https://docs.microsoft.com/en-us/azure/virtual-network/security-overview#application-security-groups
U
G
SS

PA
You have an Azure subscription named Subscription1 that contains an Azure virtual network named VNet1. VNet1 connects to your on-premises
network by using
AM
Azure ExpressRoute.
You need to connect VNet1 to the on-premises network by using a site-to-site VPN. The solution must minimize cost.
EX
Correct Answer: ADE

Reference:
HOTSPOT -
Hot Area:
U
R
U
G
SS
PA
AM
EX
Correct Answer:
Box 1: vNET6 only -

Box 2: delete peering1 -

Peering to Vnet1 is Enabled but disconnected. We need to update or re-create the remote peering to get it back to Initiated state.
Reference:
EX
AM
PA
SS
G
U
R
U
HOTSPOT -
You install the Web Server server role (IIS) on VM1 and VM2, and then add VM1 and VM2 to LB1.
LB1 is configured as shown in the LB1 exhibit. (Click the LB1 tab.)
U
Rule1 is configured as shown in the Rule1 exhibit. (Click the Rule1 tab.)
R
U
G
SS
PA
AM
EX
Hot Area:
Correct Answer:
U
R
U
G
SS
Box 1: Yes -
PA
A Basic Load Balancer supports virtual machines in a single availability set or virtual machine scale set.
Box 2: Yes -
AM
When using load-balancing rules with Azure Load Balancer, you need to specify health probes to allow Load Balancer to detect the backend
endpoint status. The configuration of the health probe and probe responses determine which backend pool instances will receive new flows.
You can use health probes to detect the failure of an application on a backend endpoint. You can also generate a custom response to a health
EX
probe and use the health probe for flow control to manage load or planned downtime. When a health probe fails, Load Balancer will stop
sending new flows to the respective unhealthy instance. Outbound connectivity is not impacted, only inbound connectivity is impacted.
Box 3: No -
Reference:
https://docs.microsoft.com/en-us/azure/load-balancer/skus
https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-custom-probe-overview
HOTSPOT -
You have an Azure virtual machine named VM1 that connects to a virtual network named VNet1. VM1 has the following configurations:
✑ Subnet: 10.0.0.0/24
✑ Availability set: AVSet
✑ Network security group (NSG): None
✑ Private IP address: 10.0.0.4 (dynamic)
✑ Public IP address: 40.90.219.6 (dynamic)
Which changes should you apply to VM1 as you configure slb1? To answer, select the appropriate options in the answer area.
Hot Area:
U
R
U
G
SS
PA
Correct Answer:
AM
EX
Change the private IP address of VM1 to static

Box 1: Remove the public IP address from VM1
Note: A public load balancer can provide outbound connections for virtual machines (VMs) inside your virtual network. These connections are
accomplished by translating their private IP addresses to public IP addresses. Public Load Balancers are used to load balance internet traffic to
your VMs.
Box 2: Create and configure an NSG
NSGs are used to explicitly permit allowed traffic. If you do not have an NSG on a subnet or NIC of your virtual machine resource, traffic is not
allowed to reach this resource.
Reference:
https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-overview

A. East US and North Europe only
B. East US only
C. East US, West Europe, and North Europe
D. East US and West Europe only
Correct Answer: B
Before creating a network interface, you must have an existing virtual network in the same location and subscription you create a network
interface in.
U
Reference:
R
U
G
SS
PA
AM
EX
You have Azure virtual machines that run Windows Server 2019 and are configured as shown in the following table.
For controso.com, you create a virtual network link named link1 as shown in the exhibit. (Click the Exhibit tab.)
U
R
U
G
SS
You discover that VM1 can resolve names in contoso.com but cannot resolve names in adatum.com. VM1 can resolve other hosts on the Internet.
PA
What should you do?
AM
A. Update the DNS suffix on VM1 to be adatum.com
B. Configure the name servers for adatum.com at the domain registrar

EX
C. Create an SRV record in the contoso.com zone
D. Modify the Access control (IAM) settings for link1
Correct Answer: A
If you use Azure Provided DNS then appropriate DNS suffix will be automatically applied to your virtual machines. For all other options you must
either use Fully
Qualified Domain Names (FQDN) or manually apply appropriate DNS suffix to your virtual machines.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances
HOTSPOT -
✑ Task1: Identify a security rule that prevents a network packet from reaching an Azure virtual machine.
✑ Task2: Validate outbound connectivity from an Azure virtual machine to an external host.
Which feature should you use for each task? To answer, select the appropriate options in the answer area.
Hot Area:
U
R
U
G
SS
PA
Correct Answer:
AM
EX
Box 1: IP flow verify -

At some point, a VM may become unable to communicate with other resources, because of a security rule. The IP flow verify capability enables
you to specify a source and destination IPv4 address, port, protocol (TCP or UDP), and traffic direction (inbound or outbound). IP flow verify
then tests the communication and informs you if the connection succeeds or fails. If the connection fails, IP flow verify tells you which.
Box 2: Connection troubleshoot -

Diagnose outbound connections from a VM: The connection troubleshoot capability enables you to test a connection between a VM and
another VM, an FQDN, a
URI, or an IPv4 address. The test returns similar information returned when using the connection monitor capability, but tests the connection at
a point in time, rather than monitoring it over time, as connection monitor does. Learn more about how to troubleshoot connections using
connection-troubleshoot.
Reference:
HOTSPOT -
You configure the network interfaces of the virtual machines to use the settings shown in the following table.
From the settings of VNET1 you configure the DNS servers shown in the following exhibit.
U
R
U
G
The virtual machines can successfully connect to the DNS server that has an IP address of 192.168.10.15 and the DNS server that has an IP
address of
SS
193.77.134.10.
PA
Hot Area:
AM
EX
Correct Answer:
Box 1: Yes -
You can specify DNS server IP addresses in the VNet settings. The setting is applied as the default DNS server(s) for all VMs in the VNet.
Box 2: No -
You can set DNS servers per VM or cloud service to override the default network settings.
Box 3: Yes -
Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-faq#name-resolution-dns
U
R
U
G
SS
PA
AM
EX
HOTSPOT -
You need to identify which resources you can move from RG1 to RG2, and which resources you can move from RG2 to RG1.
Which resources should you identify? To answer, select the appropriate options in the answer area.
Hot Area:
U
R
U
G
SS
PA
AM
EX
Correct Answer:
Box 1: IP1, Storage1 -

IP addresses and storage accounts can be moved.
Virtual networks cannot be moved.
There is no lock on RG1.
Box 2: None -
There is a delete lock on RG2.
Note: When you apply a lock at a parent scope, all resources within that scope inherit the same lock. Even resources you add later inherit the
lock from the parent.
The most restrictive lock in the inheritance takes precedence.
CanNotDelete means authorized users can still read and modify a resource, but they can't delete the resource.
ReadOnly means authorized users can read a resource, but they can't delete or update the resource. Applying this lock is similar to restricting all
authorized users to the permissions granted by the Reader role.
Reference:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources https://docs.microsoft.com/en-us/azure/azure-
resource-manager/management/move-support-resources
U
R
U
G
SS
PA
AM
EX
You have an Azure subscription that contains the virtual machines shown in the following table.
You deploy a load balancer that has the following configurations:

✑ Name: LB1
✑ Type: Internal
✑ SKU: Standard
You need to ensure that you can add VM1 and VM2 to the backend pool of LB1.
Solution: You create a Basic SKU public IP address, associate the address to the network interface of VM1, and then start VM1.
A. Yes
U
B. No
R
Correct Answer: B
A Backend Pool configured by IP address has the following limitations:
✑ Standard load balancer only U
G
Reference:
SS
https://docs.microsoft.com/en-us/azure/load-balancer/backend-pool-management
PA
AM
EX

✑ Name: LB1
✑ Type: Internal
✑ SKU: Standard
Solution: You create a Standard SKU public IP address, associate the address to the network interface of VM1, and then stop VM2.
A. Yes
U
B. No
R
Correct Answer: B
✑ Standard load balancer only U
G
Reference:
SS
PA
AM
EX

✑ Name: LB1
✑ Type: Internal
✑ SKU: Standard
Solution: You create two Standard public IP addresses and associate a Standard SKU public IP address to the network interface of each virtual
machine.
U
A. Yes
B. No
R
Correct Answer: A
A Backend Pool configured by IP address has the following limitations: U
G
✑ Standard load balancer only
SS
Reference:
PA

AM
EX
Solution: You export the client certificate from Computer1 and install the certificate on Computer2.
A. Yes
B. No
Correct Answer: A
Reference:

U
R
U
G
You deploy a web server on VM1, and then create a secure website that is accessible by using the HTTPS protocol. VM1 is used as a web server
only.
SS
You need to ensure that users can connect to the website from the Internet.
What should you do?
PA
A. Modify the protocol of Rule4
B. Delete Rule1
AM
C. For Rule5, change the Action to Allow and change the priority to 401
D. Create a new inbound rule that allows TCP protocol 443 and configure the rule to have a priority of 501.
EX
Correct Answer: C
HTTPS uses port 443.
Rule2, with priority 500, denies HTTPS traffic.
Rule5, with priority changed from 2000 to 401, would allow HTTPS traffic.
Note: Priority is a number between 100 and 4096. Rules are processed in priority order, with lower numbers processed before higher numbers,
because lower numbers have higher priority. Once traffic matches a rule, processing stops. As a result, any rules that exist with lower priorities
(higher numbers) that have the same attributes as rules with higher priorities are not processed.
Note:
There are several versions of this question in the exam. The question has two possible correct answers:
1. Change the priority of Rule3 to 450.
2. For Rule5, change the Action to Allow and change the priority to 401.
✑ Modify the action of Rule1.
✑ Change the priority of Rule6 to 100.
✑ For Rule4, change the protocol from UDP to Any.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview
Solution: From the Resource providers blade, you unregister the Microsoft.ClassicNetwork provider.
A. Yes
B. No
Correct Answer: B
Resource policy definition used by Azure Policy enables you to establish conventions for resources in your organization by describing when the
policy is enforced and what effect to take. By defining conventions, you can control costs and more easily manage your resources.
Reference:
U
R
U
G
SS
PA
AM
EX
HOTSPOT -
You manage two Azure subscriptions named Subscription1 and Subscription2.
Subscription1 has following virtual networks:
The virtual networks contain the following subnets:
Subscription2 contains the following virtual network:

✑ Name: VNETA
✑ Address space: 10.10.128.0/17
✑ Location: Canada Central
VNETA contains the following subnets:
U
R
Hot Area:
U
G
SS
PA
AM
EX
Correct Answer:
Box 1: Yes -
With VNet-to-VNet you can connect Virtual Networks in Azure across different regions.
Box 2: Yes -
Azure supports the following types of peering:
✑ Virtual network peering: Connect virtual networks within the same Azure region.
✑ Global virtual network peering: Connecting virtual networks across Azure regions.
Box 3: No -
Reference:
https://azure.microsoft.com/en-us/blog/vnet-to-vnet-connecting-virtual-networks-in-azure-across-different-regions/
https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-manage-peering#requirements-and-constraints
U
R
U
G
SS
PA
AM
EX
You have an app named App1 that is installed on two Azure virtual machines named VM1 and VM2. Connections to App1 are managed by using an
Azure Load
Balancer.
The effective network security configurations for VM2 are shown in the following exhibit.
U
R
You discover that connections to App1 from 131.107.100.50 over TCP port 443 fail.
U
G
You verify that the Load Balancer rules are configured correctly.
You need to ensure that connections to App1 can be established successfully from 131.107.100.50 over TCP port 443.
SS
Solution: You create an inbound security rule that denies all traffic from the 131.107.100.50 source and has a cost of 64999.
PA
A. Yes
B. No
AM
Correct Answer: B
Reference:
https://fastreroute.com/azure-network-security-groups-explained/
EX
Azure Load
Balancer.
U
R
You discover that connections to App1 from 131.107.100.50 over TCP port 443 fail. U
G
SS
Solution: You delete the BlockAllOther443 inbound security rule.
PA
A. Yes
B. No
AM
Correct Answer: B
Reference:
EX
Azure Load
Balancer.
U
R
U
G
SS
Solution: You modify the priority of the Allow_131.107.100.50 inbound security rule.
PA
A. Yes
B. No
AM
Correct Answer: B
The rule currently has the highest priority.
Reference:
EX
A. Yes
B. No
Correct Answer: B
Reference:
U
R
Question #68
U Topic 5
G
SS
You plan to deploy an Azure Kubernetes Service (AKS) cluster to support an app named App1. On-premises clients connect to App1 by using the
IP address of the pod.
For the AKS cluster, you need to choose a network type that will support App1.
PA
What should you choose?
A. kubenet
AM
B. Azure Container Networking Interface (CNI)
C. Hybrid Connection endpoints

EX
D. Azure Private Link
Correct Answer: B
With Azure CNI, every pod gets an IP address from the subnet and can be accessed directly. These IP addresses must be unique across your
network space.
Incorrect Answers:
A: The kubenet networking option is the default configuration for AKS cluster creation. With kubenet, nodes get an IP address from the Azure
virtual network subnet. Pods receive an IP address from a logically different address space to the Azure virtual network subnet of the nodes.
Network address translation (NAT) is then configured so that the pods can reach resources on the Azure virtual network.
C, D: AKS only supports Kubenet networking and Azure Container Networking Interface (CNI) networking
Reference:
https://docs.microsoft.com/en-us/azure/aks/concepts-network

✑ Name: LB1
✑ Type: Internal
✑ SKU: Standard
Solution: You disassociate the public IP address from the network interface of VM2.
A. Yes
U
B. No
R
Correct Answer: B
U
G
SS

PA
AM
EX
Solution: You configure a custom policy definition, and then you assign the policy to the subscription.
A. Yes
B. No
Correct Answer: A
Reference:
You have two Azure virtual networks named VNet1 and VNet2. VNet1 contains an Azure virtual machine named VM1. VNet2 contains an Azure
virtual machine named VM2.
A. IP flow verify
D. NSG flow logs
Correct Answer: C
The connection monitor capability monitors communication at a regular interval and informs you of reachability, latency, and network topology
changes between the VM and the endpoint
Incorrect Answers:
A: The IP flow verify capability enables you to specify a source and destination IPv4 address, port, protocol (TCP or UDP), and traffic direction
U
(inbound or outbound). IP flow verify then tests the communication and informs you if the connection succeeds or fails. If the connection fails,
R
IP flow verify tells you which security rule allowed or denied the communication, so that you can resolve the problem.
B: The connection troubleshoot capability enables you to test a connection between a VM and another VM, an FQDN, a URI, or an IPv4 address.
U
The test returns similar information returned when using the connection monitor capability, but tests the connection at a point in time, rather
G
than monitoring it over time, as connection monitor does.
D: The NSG flow log capability allows you to log the source and destination IP address, port, protocol, and whether traffic was allowed or denied
SS
by an NSG.
Reference:
PA
AM
EX
HOTSPOT -
You have an Azure subscription that contains the public load balancers shown in the following table.
You plan to create six virtual machines and to load balance requests to the virtual machines. Each load balancer will load balance three virtual
machines.
You need to create the virtual machines for the planned solution.
How should you create the virtual machines? To answer, select the appropriate options in the answer area.
Hot Area:
U
R
U
G
SS
Correct Answer:
PA
AM
EX
Box 1: be created in the same availability set or virtual machine scale set.
The Basic tier is quite restrictive. A load balancer is restricted to a single availability set, virtual machine scale set, or a single machine.
Box 2: be connected to the same virtual network
The Standard tier can span any virtual machine in a single virtual network, including blends of scale sets, availability sets, and machines.
Reference:
https://www.petri.com/comparing-basic-standard-azure-load-balancers
HOTSPOT -
You have an on-premises data center and an Azure subscription. The data center contains two VPN devices. The subscription contains an Azure
virtual network named VNet1. VNet1 contains a gateway subnet.
You need to create a site-to-site VPN. The solution must ensure that if a single instance of an Azure VPN gateway fails, or a single on-premises
VPN device fails, the failure will not cause an interruption that is longer than two minutes.
What is the minimum number of public IP addresses, virtual network gateways, and local network gateways required in Azure? To answer, select
Hot Area:
U
R
U
G
SS
PA
AM
EX
Correct Answer:
Box 1: 4 -
Two public IP addresses in the on-premises data center, and two public IP addresses in the VNET.
The most reliable option is to combine the active-active gateways on both your network and Azure, as shown in the diagram below.
Box 2: 2 -
Every Azure VPN gateway consists of two instances in an active-standby configuration. For any planned maintenance or unplanned disruption
that happens to the active instance, the standby instance would take over (failover) automatically, and resume the S2S VPN or VNet-to-VNet
connections.
Box 3: 2 -
Reference:
Yohtutphsa:v//edaoncsA.zmuircerossuobfstc.croipm
tio/ennt-huast/aczounrtea/ivnpsnt-wgaotveiw
rtauya/lvm
pna-cghaitneewsaays-hsighholwyanvianiltahbelefollowing table.
U
R
You perform a reverse DNS lookup for 10.0.0.4 from VM2.
Which FQDN will be returned?
U
G
A. vm1.core.windows.net
B. vm1.azure.com
SS
C. vm1.westeurope.cloudapp.azure.com
D. vm1.internal.cloudapp.net
PA
Correct Answer: B
AM
EX
Azure Load
Balancer.
U
R
G
SS
Solution: You create an inbound security rule that allows any traffic from the AzureLoadBalancer source and has a cost of 150.
PA
A. Yes
B. No
AM
Correct Answer: A
Reference:
EX
You have an Azure subscription that contains a policy-based virtual network gateway named GW1 and a virtual network named VNet1.
You need to ensure that you can configure a point-to-site connection from an on-premises computer to VNet1.
B. Reset GW1
E. Delete GW1
Correct Answer: CE
Route-based VPN devices use any-to-any (wildcard) traffic selectors, and let routing/forwarding tables direct traffic to different IPsec tunnels. It
is typically built on router platforms where each IPsec tunnel is modeled as a network interface or VTI (virtual tunnel interface).
U
E: Policy-based VPN devices use the combinations of prefixes from both networks to define how traffic is encrypted/decrypted through IPsec
tunnels. It is typically built on firewall devices that perform packet filtering. IPsec tunnel encryption and decryption are added to the packet
R
filtering and processing engine.
Incorrect Answers:
U
G
Reference:
https://docs.microsoft.com/en-us/azure/vpn-gateway/create-routebased-vpn-gateway-portal https://docs.microsoft.com/en-us/azure/vpn-
SS
gateway/vpn-gateway-connect-multiple-policybased-rm-ps
PA
AM
EX
HOTSPOT -
In Azure, you create a private DNS zone named adatum.com. You set the registration virtual network to VNet2. The adatum.com zone is
configured as shown in the following exhibit:
U
R
U
G
SS
PA
AM
EX
Hot Area:
Correct Answer:
Box 1: No -
Azure DNS provides automatic registration of virtual machines from a single virtual network that's linked to a private zone as a registration
virtual network. VM5 does not belong to the registration virtual network though.
Box 2: No -
Forward DNS resolution is supported across virtual networks that are linked to the private zone as resolution virtual networks. VM5 does belong
to a resolution virtual network.
U
Box 3: Yes -
VM6 belongs to registration virtual network, and an A (Host) record exists for VM9 in the DNS zone.
R
By default, registration virtual networks also act as resolution virtual networks, in the sense that DNS resolution against the zone works from
any of the virtual machines within the registration virtual network.
Reference: U
G
SS
PA
AM
EX
HOTSPOT -
You have an Azure subscription that contains the virtual networks shown in the following table.
The subscription contains the private DNS zones shown in the following table.
You add virtual network links to the private DNS zones as shown in the following table.
U
R
U
G
Hot Area:
SS
PA
AM
EX
Correct Answer:
Reference:
https://docs.microsoft.com/en-us/azure/dns/private-dns-virtual-network-links https://docs.microsoft.com/en-us/azure/dns/private-dns-
autoregistration
HOTSPOT -
You plan to use an Azure Resource Manager template to deploy a virtual network named VNET1 that will use Azure Bastion.
How should you complete the template? To answer, select the appropriate options in the answer area.
Hot Area:
U
R
U
G
SS
PA
AM
EX
Correct Answer:
U
R
U
G
SS
PA
Reference:
https://medium.com/charot/deploy-azure-bastion-preview-using-an-arm-template-15e3010767d6
AM
EX
A. Yes
B. No
Correct Answer: B
Use the Connection Monitor feature of Azure Network Watcher.
Reference:
https://azure.microsoft.com/en-us/updates/general-availability-azure-network-watcher-connection-monitor-in-all-public-regions/
U
R
Question #81
U Topic 5
G
SS
PA
AM
A. Yes
EX
B. No
Correct Answer: A
Reference:
A. Yes
B. No
Correct Answer: B
Reference:
U
R
U
G
SS
PA
AM
EX
DRAG DROP -
You need to load balance HTTPS connections to vm1 and vm2 by using lb1.
Select and Place:
U
R
U
G
SS
PA
AM
EX
Correct Answer:
Reference:
https://docs.microsoft.com/en-us/azure/load-balancer/tutorial-load-balancer-standard-public-zone-redundant-portal
Solution: From Azure Monitor, you create a metric on Network In and Network Out.
A. Yes
B. No
Correct Answer: B
Reference:
U
R
U
G
SS
PA
AM
EX
Azure Load
Balancer.
U
R
G
SS
Solution: You create an inbound security rule that denies all traffic from the 131.107.100.50 source and has a priority of 64999.
PA
A. Yes
B. No
AM
Correct Answer: B
Reference:
EX
DRAG DROP -
You have an Azure subscription that contains two om-premises locations named site1 and site2.
You need to connect site1 and site2 by using an Azure Virtual WAN.
Select and Place:
Correct Answer:
U
R
U
G
SS
PA
Reference:
https://docs.microsoft.com/en-us/azure/virtual-wan/virtual-wan-site-to-site-portal
AM
EX
HOTSPOT -
You have the virtual machines shown in the following table.
You have the virtual network interfaces shown in the following table.
Server1 is a DNS server that contains the resources shown in the following table.
U
R
U
You have an Azure private DNS zone named contoso.com that has a virtual network link to VNET2 and the records shown in the following table.
G
SS
PA
Hot Area:
AM
EX
Correct Answer:
You have a virtual network named VNet1 as shown in the exhibit. (Click the Exhibit tab.)
U
R
No devices are connected to VNet1.
You plan to peer VNet1 to another virtual network named VNet2. VNet2 has an address space of 10.2.0.0/16.
You need to create the peering.
U
G
SS
A. Modify the address space of VNet1.
B. Add a gateway subnet to VNet1.

PA
C. Create a subnet on VNet1 and VNet2.
D. Configure a service endpoint on VNet2.

AM
Correct Answer: A
The virtual networks you peer must have non-overlapping IP address spaces. The exhibit indicates that VNet1 has an address space of
10.2.0.0/16, which is the same as VNet2, and thus overlaps. We need to change the address space for VNet1.
EX
Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-manage-peering#requirements-and-constraints
https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-faq
VNET1 is linked to a private DNS zone named contoso.com that contains the records shown in the following table.
You need to ping VM2 from VM1.

Which DNS names can you use to ping VM2?
A. comp2.contoso.com and comp4.contoso.com only
B. comp1.contoso.com, comp2.contoso.com, comp3.contoso.com, and comp4.contoso.com
C. comp2.contoso.com only
U
D. comp1.contoso.com and comp2.contoso.com only
R
E. comp1.contoso.com, comp2.contoso.com, and comp4.contoso.com only
Correct Answer: B U
G
Reference:
https://medium.com/azure-architects/exploring-azure-private-dns-be65de08f780 https://simpledns.plus/help/dns-record-types
SS
PA
AM
EX
HOTSPOT -
You have a network security group (NSG) named NSG1 that has the rules defined in the exhibit. (Click the Exhibit tab.)
U
R
U
G
SS
NSG1 is associated to a subnet named Subnet1. Subnet1 contains the virtual machines shown in the following table.
PA
You need to add a rule to NSG1 to ensure that VM1 can ping VM2. The solution must use the principle of least privilege.
AM
How should you configure the rule? To answer, select the appropriate options in the answer area.
EX
Hot Area:
U
R
U
G
SS
PA
AM
EX
Correct Answer:
Reference:
https://www.thomasmaurer.ch/2019/09/how-to-enable-ping-icmp-echo-on-an-azure-vm/
Solution: On Computer2, you set the Startup type for the IPSec Policy Agent service to Automatic.
A. Yes
B. No
Correct Answer: B
Reference:
U
R
U
G
SS
PA
AM
EX
Question #1 Topic 6
HOTSPOT -
You have an Azure Active Directory (Azure AD) tenant named contoso.onmicrosoft.com that contains the users shown in the following table.
You enable password reset for contoso.onmicrosoft.com as shown in the Password Reset exhibit. (Click the Password Reset tab.)
You configure the authentication methods for password reset as shown in the Authentication Methods exhibit. (Click the Authentication Methods
U
tab.)
R
U
G
SS
PA
AM
EX
Hot Area:
Correct Answer:
U
R
U
G
SS
PA
Box 1: No -
AM
Box 2: No -
EX
Box 3: Yes -
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/authentication/quickstart-sspr https://docs.microsoft.com/en-us/azure/active-
directory/authentication/active-directory-passwords-faq
Question #2 Topic 6
The company‫ג‬€™s security policy states that all personal devices and corporate-owned devices must be registered or joined to Azure AD.
A remote user named User1 is unable to join a personal device to Azure AD from a home network.
What should you do?
Correct Answer: B
U
The Maximum number of devices setting enables you to select the maximum number of devices that a user can have in Azure AD. If a user
R
reaches this quota, they will not be able to add additional devices until one or more of the existing devices are removed.
Incorrect Answers:
U
C: Azure AD Join enables users to join their devices to Active Directory from anywhere as long as they have connectivity with the Internet.
D: The Users may join devices to Azure AD setting enables you to select the users who can join devices to Azure AD. Options are All, Selected
G
and None. The default is All.
SS
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/devices/device-management-azure-portal http://techgenix.com/pros-and-cons-azure- ad-
join/
PA
Question #3 Topic 6
AM
EX

A. Yes
B. No
Correct Answer: A
Reference:
Question #4 Topic 6

A. Service Map
C. Network Performance Monitor
D. Effective routes
Correct Answer: C
Network Performance Monitor is a cloud-based hybrid network monitoring solution that helps you monitor network performance between
various points in your network infrastructure. It also helps you monitor network connectivity to service and application endpoints and monitor
the performance of Azure ExpressRoute.
You can monitor network connectivity across cloud deployments and on-premises locations, multiple data centers, and branch offices and
mission-critical multitier applications or microservices. With Performance Monitor, you can detect network issues before users complain.
Reference:
U
R
U
G
SS
PA
AM
EX
Question #5 Topic 6
DRAG DROP -
You need to restore the deleted files to an on-premises Windows Server 2016 computer as quickly as possible.
Select and Place:
U
R
U
G
SS
PA
AM
EX
Correct Answer:
Step 1: From the Azure portal, click File Recovery from the vault
Step 2. Select a restore point that contains the deleted files
Step 3: Download and run the script to mount a drive on the local computer
Generate and download script to browse and recover files:
Step 4: Copy the files using File Explorer!
After the disks are attached, use Windows File Explorer to browse the new volumes and files. The restore files functionality provides access to
all files in a recovery point. Manage the files via File Explorer as you would for normal files.
Step 1-3 below:
To restore files or folders from the recovery point, go to the virtual machine and perform the following steps:
1. Sign in to the Azure portal and in the left pane, select Virtual machines. From the list of virtual machines, select the virtual machine to open
that virtual machine's dashboard.
2. In the virtual machine's menu, select Backup to open the Backup dashboard.
3. In the Backup dashboard menu, select File Recovery.
The File Recovery menu opens.
U
R
U
G
SS
PA
AM
EX
4. From the Select recovery point drop-down menu, select the recovery point that holds the files you want. By default, the latest recovery point is
already selected.
5. Select Download Executable (for Windows Azure VMs) or Download Script (for Linux Azure VMs, a python script is generated) to download
the software used to copy files from the recovery point.
Running the script and identifying volumes:
For Linux machines, a python script is generated. Download the script and copy it to the relevant/compatible Linux server.
Reference:
https://docs.microsoft.com/en-us/azure/backup/backup-azure-restore-files-from-vm https://docs.microsoft.com/en-us/azure/backup/backup-
azure-vms-automation#restore-files-from-an-azure-vm-backup
EX
AM
PA
SS
G
U
R
U
Question #6 Topic 6
HOTSPOT -
You create a virtual machine named VM1 in Subscription1. VM1 is not protected by Azure Backup.
You need to protect VM1 by using Azure Backup. Backups must be created at 01:00 and stored for 30 days.
Hot Area:
U
R
U
G
SS
Correct Answer:
PA
AM
EX

You can set up a Recovery Services vault and configure backup for multiple Azure VMs.
Box 2: A backup policy -

In Choose backup policy, do one of the following:
✑ Leave the default policy. This backs up the VM once a day at the time specified, and retains backups in the vault for 30 days.
✑ Select an existing backup policy if you have one.
✑ Create a new policy, and define the policy settings.
Reference:
Question #7 Topic 6

You are creating an alert rule in Azure Monitor to notify an administrator when an error is logged in the System event log of VM1.
Which target resource should you monitor in the alert rule?
A. virtual machine extension
B. virtual machine
C. metric alert
D. Azure Log Analytics workspace
Correct Answer: D
For the first step to create the new alert tule, under the Create Alert section, you are going to select your Log Analytics workspace as the
resource, since this is a log based alert signal.
Reference:
https://docs.microsoft.com/en-us/windows-server/storage/storage-spaces/configure-azure-monitor
U
R
U
G
SS
PA
AM
EX
Question #8 Topic 6

What should you do?
A. From Azure Cost Management, view Cost Analysis
B. From Azure Advisor, modify the Advisor configuration
C. From Microsoft Azure Storage Explorer, view the Account Management properties
D. From Azure Cost Management, view Advisor Recommendations
Correct Answer: D
From Home ‫ג‬€"> Cost Management + Billing ‫ג‬€"> Cost Management, scroll down on the options and select View Recommendations:
U
R
U
G
SS
PA
AM
Azure Cost Management / Advisor -

From here you will see the recommendations for your subscription, if you have orphaned disks, they will be listed.
EX
Reference:
https://codeserendipity.com/2020/07/08/microsoft-azure-find-unattached-disks-that-can-be-deleted-and-other-recommendations/
Question #9 Topic 6

You need to provide the developers of webapp1 with real-time access to the connection errors. The solution must provide all the connection error
details.
Correct Answer: A
You have an Azure subscription that has a Recovery Services vault named Vault1. The subscription contains the virtual machines shown in the
following table:

A. VM1 and VM3 only
C. VM1 and VM2 only
D. VM1 only
Correct Answer: B
U
R
Azure Backup supports backup of VM that are shutdown or offiine.
Reference: U
G
https://docs.microsoft.com/en-us/azure/backup/backup-support-matrix-iaas https://docs.microsoft.com/en-us/azure/virtual-
machines/linux/endorsed-distros
SS
PA
AM
EX
HOTSPOT -
You create a Recovery Services vault backup policy named Policy1 as shown in the following exhibit:
U
R
U
G
SS
PA
Hot Area:
AM
EX
Correct Answer:
Box 1: 10 years -
Box 2: 36 months -
The monthly backup point occurs on the 1
of every month and its retention period is 36 months.
U
st
R
U
G
SS
PA
AM
EX
Correct Answer: A
U
A Recovery Services vault is a storage entity in Azure that houses data. The data is typically copies of data, or configuration information for
virtual machines
R
(VMs), workloads, servers, or workstations. You can use Recovery Services vaults to hold backup data for various Azure services
Reference:
U
G
SS
PA
AM
EX
HOTSPOT -
You have an Azure subscription that contains an Azure Storage account named storage1 and the users shown in the following table.
You plan to monitor storage1 and to configure email notifications for the signals shown in the following table.
You need to identify the minimum number of alert rules and action groups required for the planned monitoring.
How many alert rules and action groups should you identify? To answer, select the appropriate options in the answer area.
Hot Area:
U
R
U
G
SS
PA
AM
EX
Correct Answer:
You have an Azure subscription that contains the identities shown in the following table.
User1, Principal1, and Group1 are assigned the Monitoring Reader role.
An action group named AG1 has the Email Azure Resource Manager Role notification type and is configured to email the Monitoring Reader role.
You create an alert rule named Alert1 that uses AG1.
You need to identity who will receive an email notification when Alert1 is triggered.
Who should you identify?
U
A. User1 and Principal1 only
R
B. User1, User2, Principal1, and Principal2
C. User1 only
U
G
D. User1 and User2 only
SS
Correct Answer: C
Email will only be sent to Azure AD user members of the Monitoring Reader role. Email will not be sent to Azure AD groups or service principals.
PA
Reference:
https://docs.microsoft.com/en-us/azure/azure-monitor/platform/action-groups
AM
EX
HOTSPOT -
U
R
U
G
SS
PA
AM
EX
You configure the backup of VM1 to use Policy1 on Thursday, January 1 at 1:00 AM.
How many recovery points are available on January 8 and January 15? To answer, select the appropriate options in the answer area.
Hot Area:
Correct Answer:
Box 1: 6 -
5 latest daily recovery points, which includes the weekly backup from the previous Sunday, plus the monthly recovery point.
Box 2: 8 -
Reference:
https://social.technet.microsoft.com/Forums/en-US/854ab6ae-79aa-4bad-ac65-471c4d422e94/daily-monthly-yearly-recovery-points-and-
U
storage-used? forum=windowsazureonlinebackup
R
U
G
SS
PA
AM
EX
Topic 7 - Testlet 1
Question #1 Topic 7
Introductory Info
Case study -
This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However,
there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions
included on this exam in the time provided.
To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might
contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is
independent of the other questions in this case study.
At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to
the next section of the exam. After you begin a new section, you cannot return to this section.
To start the case study -

To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study
before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem
statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the
subsequent tabs. When you are ready to answer a question, click the Question button to return to the question.
Overview -
U
Contoso, Ltd. is a manufacturing company that has offices worldwide. Contoso works with partner organizations to bring products to market.
Contoso products are manufactured by using blueprint files that the company authors and maintains.
R
Existing Environment -
U
G
File servers
Domain controllers
SS
Microsoft SQL Server servers

Your network contains an Active Directory forest named contoso.com. All servers and client computers are joined to Active Directory.
PA
A SQL database
A web front end
AM
A processing middle tier -
Each tier is comprised of five virtual machines. Users access the web front end by using HTTPS only.
EX
Requirements -
Planned Changes -
Move all the tiers of App1 to Azure.
Move the existing product blueprint files to Azure Blob storage.
Create a hybrid directory to support an upcoming Microsoft 365 migration project.
Technical Requirements -
Ensure that all the virtual machines for App1 are protected by backups.
Copy the blueprint files to Azure over the Internet.
Ensure that the blueprint files are stored in the archive storage tier.
Ensure that partner access to the blueprint files is secured and temporary.
Prevent user passwords or hashes of passwords from being stored in Azure.
Use unmanaged standard storage for the hard disks of the virtual machines.
Ensure that when users join devices to Azure Active Directory (Azure AD), the users use a mobile phone to verify their identity.
Minimize administrative effort whenever possible.
User Requirements -
Ensure that only users who are part of a group named Pilot can join devices to Azure AD.
Designate a new user named Admin1 as the service admin for the Azure subscription.
Admin1 must receive email alerts regarding service outages.
Ensure that a new user named User3 can create network objects for the Azure subscription.
Question
HOTSPOT -
You need to configure the Device settings to meet the technical requirements and the user requirements.
Which two settings should you modify? To answer, select the appropriate settings in the answer area.
Hot Area:
U
R
U
G
SS
PA
AM
EX
Correct Answer:
U
R
U
G
SS
PA
Box 1: Selected -
AM
Box 2: Yes -
EX
Question #2 Topic 7
Introductory Info
Case study -

Overview -
U
R
U
G
File servers
Domain controllers
SS

PA
A SQL database
A web front end
AM
EX
Requirements -
Planned Changes -
User Requirements -
Question
You need to meet the user requirement for Admin1.
What should you do?
A. From the Azure Active Directory blade, modify the Groups
B. From the Azure Active Directory blade, modify the Properties
C. From the Subscriptions blade, select the subscription, and then modify the Access control (IAM) settings
D. From the Subscriptions blade, select the subscription, and then modify the Properties
Correct Answer: D
Scenario:
✑ Designate a new user named Admin1 as the service admin for the Azure subscription.
U
✑ Admin1 must receive email alerts regarding service outages.
R
Follow these steps to change the Service Administrator in the Azure portal.
1. Make sure your scenario is supported by checking the limitations for changing the Service Administrator.
2. Sign in to the Azure portal as the Account Administrator.
3. Open Cost Management + Billing and select a subscription. U
G
4. In the left navigation, click Properties.
SS
5. Click Service Admin.

Reference:
https://docs.microsoft.com/en-us/azure/role-based-access-control/classic-administrators
PA
Topic 8 - Testlet 2
AM
EX
Question #1 Topic 8
Introductory Info
Case study -

Overview -
U
R
U
G
File servers
Domain controllers
SS

PA
A SQL database
A web front end
AM
EX
Requirements -
Planned Changes -
User Requirements -
Question
A. a recovery plan
C. a backup policy
Correct Answer: D
A Recovery Services vault is a logical container that stores the backup data for each protected resource, such as Azure VMs. When the backup
job for a protected resource runs, it creates a recovery point inside the Recovery Services vault.
U
Scenario:
R
Reference: U
G
SS
PA
AM
EX
Question #2 Topic 8
Introductory Info
Case study -

Overview -
U
R
U
G
File servers
Domain controllers
SS

PA
A SQL database
A web front end
AM
EX
Requirements -
Planned Changes -
User Requirements -
Question
What should you do?
A. Generate an access key. Map a drive, and then copy the files by using File Explorer.
B. Use Azure Storage Explorer to copy the files.
C. Use the Azure Import/Export service.
D. Generate a shared access signature (SAS). Map a drive, and then copy the files by using File Explorer.
Correct Answer: B
Azure Storage Explorer is a free tool from Microsoft that allows you to work with Azure Storage data on Windows, macOS, and Linux. You can
use it to upload and download data from Azure blob storage.
U
Scenario:
R
Technical Requirements include: Copy the blueprint files to Azure over the Internet.
Reference:
U
https://docs.microsoft.com/en-us/azure/machine-learning/team-data-science-process/move-data-to-azure-blob-using-azure-storage-explorer
G
SS
PA
AM
EX
Question #3 Topic 8
Introductory Info
Case study -

Overview -
U
R
U
G
File servers
Domain controllers
SS

PA
A SQL database
A web front end
AM
EX
Requirements -
Planned Changes -
User Requirements -
Question
HOTSPOT -
Hot Area:
U
R
U
G
Correct Answer:
SS
PA
AM
EX
Box 1: Yes -
Contoso is moving the existing product blueprint files to Azure Blob storage.
Use unmanaged standard storage for the hard disks of the virtual machines. We use Page Blobs for these.
Box 2: No -
Box 3: No
Topic 9 - Testlet 3
Question #1 Topic 9
Introductory Info
Case study -

Overview -
U
General Overview -
R
Contoso, Ltd. is a consulting company that has a main office in Montreal and branch offices in Seattle and New York.
Environment - U
G
SS
Contoso has an Azure subscription named Sub1 that is linked to an Azure Active Directory (Azure AD) tenant. The network contains an on-
premises Active
Directory domain that syncs to the Azure AD tenant.
PA
The Azure AD tenant contains the users shown in the following table.
AM
EX
Sub1 contains two resource groups named RG1 and RG2 and the virtual networks shown in the following table.
User1 manages the resources in RG1. User4 manages the resources in RG2.
Sub1 contains virtual machines that run Windows Server 2019 as shown in the following table
No network security groups (NSGs) are associated to the network interfaces or the subnets.
Sub1 contains the storage accounts shown in the following table.
Requirements -
Planned Changes -
Create a blob container named container1 and a file share named share1 that will use the Cool storage tier.
Create a storage account named storage5 and configure storage replication for the Blob service.
Create an NSG named NSG1 that will have the custom inbound security rules shown in the following table.
U
R
Associate NSG1 to the network interface of VM1.
Create an NSG named NSG2 that will have the custom outbound security rules shown in the following table.
U
G
SS
Associate NSG2 to VNET1/Subnet2.

PA
Create container1 and share1.
AM
Use the principle of least privilege.

Create an Azure AD security group named Group4.
Back up the Azure file shares and virtual machines by using Azure Backup.
Trigger an alert if VM1 or VM2 has less than 20 GB of free space on volume C.
EX
Enable User1 to create Azure policy definitions and User2 to assign Azure policies to RG1.
Create an internal Basic Azure Load Balancer named LB1 and connect the load balancer to VNET1/Subnet1
Enable flow logging for IP traffic from VM5 and retain the flow logs for a period of eight months.
Whenever possible, grant Group4 Azure role-based access control (Azure RBAC) read-only permissions to the Azure file shares.
Question
HOTSPOT -
You need to create container1 and share1.
Which storage accounts should you use for each resource? To answer, select the appropriate options in the answer area.
Hot Area:
U
R
U
G
SS
Correct Answer:
PA
AM
Reference:
EX
https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-storage-tiers https://docs.microsoft.com/en-
us/azure/storage/common/storage-account-overview
Question #2 Topic 9
Introductory Info
Case study -

Overview -
U
General Overview -
R
Contoso, Ltd. is a consulting company that has a main office in Montreal and branch offices in Seattle and New York.
Environment - U
G
SS
Contoso has an Azure subscription named Sub1 that is linked to an Azure Active Directory (Azure AD) tenant. The network contains an on-
premises Active
Directory domain that syncs to the Azure AD tenant.
PA
The Azure AD tenant contains the users shown in the following table.
AM
EX
Sub1 contains two resource groups named RG1 and RG2 and the virtual networks shown in the following table.
User1 manages the resources in RG1. User4 manages the resources in RG2.
Sub1 contains virtual machines that run Windows Server 2019 as shown in the following table
No network security groups (NSGs) are associated to the network interfaces or the subnets.
Sub1 contains the storage accounts shown in the following table.
Requirements -
Planned Changes -
Create a blob container named container1 and a file share named share1 that will use the Cool storage tier.
Create a storage account named storage5 and configure storage replication for the Blob service.
Create an NSG named NSG1 that will have the custom inbound security rules shown in the following table.
U
R
Associate NSG1 to the network interface of VM1.
Create an NSG named NSG2 that will have the custom outbound security rules shown in the following table.
U
G
SS
Associate NSG2 to VNET1/Subnet2.

PA
Create container1 and share1.
AM
Use the principle of least privilege.

Create an Azure AD security group named Group4.
Back up the Azure file shares and virtual machines by using Azure Backup.
Trigger an alert if VM1 or VM2 has less than 20 GB of free space on volume C.
EX
Enable User1 to create Azure policy definitions and User2 to assign Azure policies to RG1.
Create an internal Basic Azure Load Balancer named LB1 and connect the load balancer to VNET1/Subnet1
Enable flow logging for IP traffic from VM5 and retain the flow logs for a period of eight months.
Whenever possible, grant Group4 Azure role-based access control (Azure RBAC) read-only permissions to the Azure file shares.
Question
HOTSPOT -
You need to create storage5. The solution must support the planned changes.
Which type of storage account should you use, and which account should you configure as the destination storage account? To answer, select the
Hot Area:
Correct Answer:
U
R
U
G
SS
PA
AM
ToRepfiecre1n0ce- :Testlet 4
https://docs.microsoft.com/en-us/azure/storage/blobs/object-replication-configure?tabs=portal
EX
Introductory Info
Case study -

Overview -
U
Litware, Inc. is a consulting company that has a main office in Montreal and two branch offices in Seattle and New York.
The Montreal office has 2,000 employees. The Seattle office has 1,000 employees. The New York office has 200 employees.
R
All the resources used by Litware are hosted on-premises.
U
Litware creates a new Azure subscription. The Azure Active Directory (Azure AD) tenant uses a domain named litware.onmicrosoft.com. The
tenant uses the
G
Premium P1 pricing tier.
SS
The network contains an Active Directory forest named litware.com. All domain controllers are configured as DNS servers and host the
litware.com DNS zone.
PA
Litware has finance, human resources, sales, research, and information technology departments. Each department has an organizational unit (OU)
that contains all the accounts of that respective department. All the user accounts have the department attribute set to their respective
department. New users are added frequently.
AM
Litware.com contains a user named User1.

All the offices connect by using private connections.
Litware has data centers in the Montreal and Seattle offices. Each office has a firewall that can be configured as a VPN device.
EX
All infrastructure servers are virtualized. The virtualization environment contains the servers in the following table.
Litware uses two web applications named App1 and App2. Each instance on each web application requires 1 GB of memory.
The network security team implements several network security groups (NSGs)
Requirements -
Planned Changes -
Litware plans to implement the following changes:
Deploy Azure ExpressRoute to the Montreal office.
Migrate the virtual machines hosted on Server1 and Server2 to Azure.
Synchronize on-premises Active Directory to Azure Active Directory (Azure AD).
Migrate App1 and App2 to two Azure web apps named WebApp1 and WebApp2.
Litware must meet the following technical requirements:
Ensure that WebApp1 can adjust the number of instances automatically based on the load and can scale up to five instances.
Ensure that VM3 can establish outbound connections over TCP port 8080 to the applications servers in the Montreal office.
Ensure that routing information is exchanged automatically between Azure and the routers in the Montreal office.
Enable Azure Multi-Factor Authentication (MFA) for the users in the finance department only.
Ensure that webapp2.azurewebsites.net can be accessed by using the name app2.litware.com.
Connect the New York office to VNet1 over the Internet by using an encrypted connection.
Create a workflow to send an email message when the settings of VM4 are modified.
Create a custom Azure role named Role1 that is based on the Reader role.
Minimize costs whenever possible.
Question
A. Diagram in VNet1
B. Diagnostic settings in Azure Monitor
U
C. Diagnose and solve problems in Traffic Manager profiles
D. The security recommendations in Azure Advisor
R
U
G
Correct Answer: E
SS
IP flow verify checks if a packet is allowed or denied to or from a virtual machine. The information consists of direction, protocol, local IP,
remote IP, local port, and remote port. If the packet is denied by a security group, the name of the rule that denied the packet is returned. While
PA
any source or destination IP can be chosen,

IP flow verify helps administrators quickly diagnose connectivity issues from or to the internet and from or to the on-premises environment.
Reference:
AM
EX
Topic 11 - Testlet 5
Introductory Info
Case study -

Overview -
U
R
U
tenant uses the
G
SS
PA
AM

EX
Requirements -
Planned Changes -
Question
You need to ensure that VM1 can communicate with VM4. The solution must minimize the administrative effort.
What should you do?
A. Create an NSG and associate the NSG to VM1 and VM4.
B. Establish peering between VNET1 and VNET3.
C. Assign VM4 an IP address of 10.0.1.5/24.
U
D. Create a user-defined route from VNET1 to VNET3.
R
Correct Answer: C
Reference:
https://docs.microsoft.com/en-us/azure/vpn-gateway/tutorial-site-to-site-portalU
G
SS
PA
AM
EX
Introductory Info
Case study -

Overview -
U
R
U
tenant uses the
G
SS
PA
AM

EX
Requirements -
Planned Changes -
Question
HOTSPOT -
Hot Area:
U
R
U
G
SS
PA
AM
EX
Correct Answer:
Box 1: Create a virtual network gateway and a local network gateway.

Azure VPN gateway. The VPN gateway service enables you to connect the VNet to the on-premises network through a VPN appliance. For more
information, see
Connect an on-premises network to a Microsoft Azure virtual network. The VPN gateway includes the following elements:
✑ Virtual network gateway. A resource that provides a virtual VPN appliance for the VNet. It is responsible for routing traffic from the on-
premises network to the
VNet.
✑ Local network gateway. An abstraction of the on-premises VPN appliance. Network traffic from the cloud application to the on-premises
network is routed through this gateway.
✑ Connection. The connection has properties that specify the connection type (IPSec) and the key shared with the on-premises VPN appliance
to encrypt traffic.
✑ Gateway subnet. The virtual network gateway is held in its own subnet, which is subject to various requirements, described in the
Recommendations section below.
On premises create a site-to-site connection for the virtual network gateway and the local network gateway.
Scenario: Connect the New York office to VNet1 over the Internet by using an encrypted connection.
Incorrect Answers:
Azure ExpressRoute: Established between your network and Azure, through an ExpressRoute partner. This connection is private. Traffic does not
go over the internet.
U
Reference:
https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/vpn
R
U
G
SS
PA
AM
EX
Introductory Info
Case study -

Overview -
U
R
U
G
File servers
Domain controllers
SS

PA
A SQL database
A web front end
AM
EX
Requirements -
Planned Changes -
User Requirements -
Question
HOTSPOT -
What should you include in the recommendation? To answer, select the appropriate options in the answer area.
Hot Area:
U
R
U
G
SS
PA
Correct Answer:
AM
EX
This reference architecture shows how to deploy VMs and a virtual network configured for an N-tier application, using SQL Server on Windows
for the data tier.
Scenario: You have a public-facing application named App1. App1 is comprised of the following three tiers:
✑ A SQL database
✑ A web front end
✑ A processing middle tier
✑ Move all the virtual machines for App1 to Azure.
✑ Minimize the number of open ports between the App1 tiers.
Reference:
U
R
U
G
SS
PA
AM
EX
Introductory Info
Case study -

Overview -
U
R
U
G
File servers
Domain controllers
SS

PA
A SQL database
A web front end
AM
EX
Requirements -
Planned Changes -
User Requirements -
Question
You are planning the move of App1 to Azure.
You create a network security group (NSG).
You need to recommend a solution to provide users with access to App1.
A. Create an incoming security rule for port 443 from the Internet. Associate the NSG to the subnet that contains the web servers.
B. Create an outgoing security rule for port 443 from the Internet. Associate the NSG to the subnet that contains the web servers.
C. Create an incoming security rule for port 443 from the Internet. Associate the NSG to all the subnets.
D. Create an outgoing security rule for port 443 from the Internet. Associate the NSG to all the subnets.
Correct Answer: A
U
Incoming and the web server subnet only, as users access the web front end by using HTTPS only.
R
Note Scenario: You have a public-facing application named App1. App1 is comprised of the following three tiers:
✑ A SQL database
✑ A web front end
✑ A processing middle tier U
G
SS
PA
AM
EX
Introductory Info
Case study -

Overview -
U
R
U
tenant uses the
G
SS
PA
AM

EX
Requirements -
Planned Changes -
Question
HOTSPOT -
Which command should you run before you create Role1? To answer, select the appropriate options in the answer area.
Hot Area:
U
R
U
G
SS
PA
Correct Answer:
AM
EX
Introductory Info
Case study -

Overview -
U
R
U
tenant uses the
G
SS
PA
AM

EX
Requirements -
Planned Changes -
Question
You need to recommend a solution to automate the configuration for the finance department users. The solution must meet the technical
requirements.
A. Azure AD B2C
U
R
Correct Answer: B
U
Scenario: Ensure Azure Multi-Factor Authentication (MFA) for the users in the finance department only.
G
The recommendation is to use conditional access policies that can then be targeted to groups of users, specific applications, or other
SS
conditions.
Reference:
PA
AM
EX
Question #319
You have an Azure subscription that contains an Azure Active Directory (Azure AD) tenant named
adatum.com. The tenant contains 500 user accounts.
You deploy Microsoft Office 365. You configure Office 365 to use the user accounts in adatum.com.
You configure 60 users to connect to mailboxes in Microsoft Exchange Online.
You need to ensure that the 60 users use Azure Multi-Factor Authentication (MFA) to connect to the
Exchange Online mailboxes. The solution must only affect connections to the Exchange Online
mailboxes.
What should you do?
• A. From the multi-factor authentication page, configure the Multi-Factor Auth status for each user
• B. From Azure Active Directory admin center, create a conditional access policy
• C. From the multi-factor authentication page, modify the verification options
• D. From the Azure Active Directory admin center, configure an authentication method
Correct Answer: A
U
Reference:
R
U
Question #320
G
You have an Azure subscription. All users are enabled for multi-factor authentication (MFA).
SS
You need to ensure that the users can lock out their own account if they receive an unsolicited MFA
request from Azure.
Which MFA settings should you configure?
PA
• A. Block/unblock users
• B. Providers
M
• C. Notifications
• D. Fraud alert
A
Correct Answer: D
EX
Configure the fraud alert feature so that your users can report fraudulent attempts to access their resources.
Users can report fraud attempts by using the mobile app or through their phone.
Configuration options include:
Block user when fraud is reported: If a user reports fraud, their account is blocked for 90 days or until an
administrator unblocks their account. An administrator can review sign-ins by using the sign-in report, and take
appropriate action to prevent future fraud. An administrator can then unblock the user's account.
References:
https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-mfasettings#fraud-alert
Question #321
You have a Microsoft 365 subscription and a hybrid deployment of Azure Active Directory (Azure AD).
User identities and password hashes are synced.
You have a user account named User1.
From Active Directory, you select the User must change password at next logon account option for
User1.
What will occur if User1 attempts to sigh in to myapps.microsoft.com?
• A. User1 will be prompted for a password change.
• B. User1 will sign in by using the old password.
• C. User1 will be prevented from signing in.
Correct Answer: C
Troubleshoot password synchronization
Some users can't sign in to Office 365, Azure, or Microsoft Intune
In this scenario, passwords of most users appear to be syncing. However, there are some users whose
passwords appear not to sync. The following are scenarios in which a user cannot sign in to a Microsoft cloud
service such as Office 365, Azure, or Intune. They include information about how to troubleshoot each
scenario.
Scenario 1: The "User must change password at next logon" check box is selected for the user's account
To resolve this issue, follow these steps:
1. Do one of the following:
In the user account properties in Active Directory Users and Computers, clear the User must change password
at next logon check box.
Have the user change their on-premises user account password.
2. Wait a few minutes for the change to sync between the on-premises Active Directory Domain Services (AD
U
DS) and Azure AD.
R
References:
https://support.microsoft.com/en-us/help/2855271/how-to-troubleshoot-password-synchronization-when-using-
U
an-azure-ad-sy
Question #322 G
SS
You have an Azure Active Directory (Azure AD) tenant named contoso.com. Multi-factor
authentication (MFA) is enabled for all users.
PA
You need to provide users with the ability to bypass MFA for 10 days on devices to which they have
successfully signed in by using MFA.
What should you do?
M
• A. From the multi-factor authentication page, configure the users' settings.

A
• B. From Azure AD, create a conditional access policy.

• C. From the multi-factor authentication page, configure the service settings.
EX
• D. From the MFA blade in Azure AD, configure the MFA Server settings
Correct Answer: C
Enable remember Multi-Factor Authentication
1. Sign in to the Azure portal.
2. On the left, select Azure Active Directory > Users.
3. Select Multi-Factor Authentication.
4. Under Multi-Factor Authentication, select service settings.
5. On the Service Settings page, manage remember multi-factor authentication, select the Allow
users to remember multi-factor authentication on devices they trust option.
6. Set the number of days to allow trusted devices to bypass two-step verification. The default is 14
days.
7. Select Save.
References:
Question #323
You enable multi-factor authentication for all users.
Some users report that the email applications on their mobile device cannot connect to their Microsoft
Exchange Online mailbox. The users can access Exchange
Online by using a web browser and from Microsoft Outlook 2016 on their computer.
You need to ensure that the users can use the email applications on their mobile device.
What should you instruct the users to do?
• A. Reinstall the Microsoft Authenticator app.

• B. Create an app password.
• C. Enable self-service password reset.
• D. Reset the Azure Active Directory (Azure AD) password.
Correct Answer: B
If you're enabled for multi-factor authentication, make sure that you have set up app passwords.
Note: During your initial two-factor verification registration process, you're provided with a single app
password. If you require more than one, you'll have to create them yourself.
U
Go to the Additional security verification page.
References:
R
https://docs.microsoft.com/en-us/office365/troubleshoot/sign-in/sign-in-to-office-365-azure-intune
U
https://docs.microsoft.com/sv-se/azure/active-directory/user-help/multi-factor-authentication-end-user-
app-passwords
G
SS
Question #324

PA
✑ 100 Azure virtual machines

✑ 20 Azure SQL databases
✑ 50 Azure file shares
M
You need to create a daily backup of all the resources by using Azure Backup.
What is the minimum number of backup policies that you must create?
A
EX
• A. 1
• B. 2
• C. 3
• D. 150
• E. 170
Correct Answer: C
There is a limit of 100 VMs that can be associated to the same backup policy from portal. We
recommend that for more than 100 VMs, create multiple backup policies with same schedule or
different schedule.
One policy for VMS, one for SQL databases, and one for the file shares.
References:
https://docs.microsoft.com/en-us/azure/backup/backup-azure-vm-backup-faq
Question #325
You have an Azure subscription named Subscription1 and two Azure Active Directory (Azure AD)
tenants named Tenant1 and Tenant2.
Subscription1 is associated to Tenant1. Multi-factor authentication (MFA) is enabled for all the users
in Tenant1.
You need to enable MFA for the users in Tenant2. The solution must maintain MFA for Tenant1.
• A. Change the directory for Subscription1.

• B. Configure the MFA Server setting in Tenant1.
• C. Create and link a subscription to Tenant2.
• D. Transfer the administration of Subscription1 to a global administrator of Tenant2.
Correct Answer: C
Question #326
U
You set the multi-factor authentication status for a user named admin1@contoso.com to Enabled.
Admin1 accesses the Azure portal by using a web browser.
R
Which additional security verifications can Admin1 use when accessing the Azure portal?
U
• A. a phone call, a text message that contains a verification code, and a notification or a verification
•
code sent from the Microsoft Authenticator app G
B. an app password, a text message that contains a verification code, and a notification sent from the
SS
Microsoft Authenticator app
• C. an app password, a text message that contains a verification code, and a verification code sent
from the Microsoft Authenticator app
PA
• D. a phone call, an email message that contains a verification code, and a text message that contains
an app password
M
Correct Answer: A
A
Question #327
EX
• A. MX
• B. SRV
• C. DNSKEY
• D. NSEC
Correct Answer: A
References:
Question #328
You hire a temporary vendor. The vendor uses a Microsoft account that has a sign-in
of user1@outlook.com.
You need to ensure that the vendor can authenticate to the tenant by using user1@outlook.com.
What should you do?
• A. From the Azure portal, add a custom domain name, create a new Azure AD user, and then
specify user1@outlook.com as the username.
• B. From Azure Cloud Shell, run the New-AzureADUser cmdlet and specify the
""UserPrincipalName user1@outlook.com parameter.
• C. From the Azure portal, add a new guest user, and then specify user1@outlook.com as the email
address.
• D. From Windows PowerShell, run the New-AzureADUser cmdlet and specify the
""UserPrincipalName user1@outlook.com parameter.
U
Correct Answer: D
R
UserPrincipalName - contains the UserPrincipalName (UPN) of this user. The UPN is what the user
will use when they sign in into Azure AD. The common structure is @, so for Abby Brown in
U
Contoso.com, the UPN would be AbbyB@contoso.com
Example:
G
To create the user, call the New-AzureADUser cmdlet with the parameter values: powershell New-
SS
AzureADUser -AccountEnabled $True -DisplayName "Abby Brown" -PasswordProfile
$PasswordProfile -MailNickName "AbbyB" -
UserPrincipalName "AbbyB@contoso.com"
PA
References:
https://docs.microsoft.com/bs-cyrl-ba/powershell/azure/active-directory/new-user-
sample?view=azureadps-2.0
M
Question #329
A
EX
From the MFA Server blade, you open the Block/unblock users blade as shown in the exhibit.
What caused AlexW to be blocked?
• A. The user account password expired.

• B. The user entered an incorrect PIN four times within 10 minutes.
• C. An administrator manually blocked the user.
• D. The user reported a fraud alert when prompted for additional authentication.
Correct Answer: C
An Administrator can block a user:
1. Sign in to the Azure portal as an administrator.
2. Browse to Azure Active Directory > MFA > Block/unblock users.
3. Select Add to block a user.
4. Select the Replication Group. Enter the username for the blocked user as username@domain.com. Enter a
comment in the Reason field, for example: Lost phone.
5. Select Add to finish blocking the user.
Reference:
Question #330
You have an Active Directory forest named contoso.com.

You install and configure Azure AD Connect to use password hash synchronization as the single
U
sign-on (SSO) method. Staging mode is enabled.
You review the synchronization results and discover that the Synchronization Service Manager does
R
not display any sync jobs.
You need to ensure that the synchronization completes successfully.
U
What should you do?
•
G
A. Run Azure AD Connect and set the SSO method to Pass-through Authentication.
SS
• B. From Synchronization Service Manager, run a full import.
• C. From Azure PowerShell, run Start-AdSyncSyncCycle ""PolicyType Initial.
• D. Run Azure AD Connect and disable staging mode
PA
Correct Answer: D
Staging mode must be disabled. If the Azure AD Connect server is in staging mode, password hash
M
synchronization is temporarily disabled.

References:
A
https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnectsync-troubleshoot-
password-hash-synchronization#no-passwords- are-synchronized-troubleshoot-by-using-the-troubleshooting-
EX
task
Question #331

All administrators must enter a verification code to access the Azure portal.
You need to ensure that the administrators can access the Azure portal only from your on-premises
network.
• A. an Azure AD Identity Protection user risk policy.

• B. the multi-factor authentication service settings.
• C. the default for all the roles in Azure AD Privileged Identity Management
• D. an Azure AD Identity Protection sign-in risk policy
Correct Answer: B.
Question #332
You have two Azure Active Directory (Azure AD) tenants named contoso.com and fabrikam.com.
You have a Microsoft account that you use to sign in to both tenants.
You need to configure the default sign-in tenant for the Azure portal.
What should you do?
• A. From Azure Cloud Shell, run Set-AzureRmSubscription.

• B. From Azure Cloud Shell, run Set-AzureRmContext.
• C. From the Azure portal, configure the portal settings.
• D. From the Azure portal, change the directory.
Correct Answer: B
The Set-AzureRmContext cmdlet sets authentication information for cmdlets that you run in the current
session. The context includes tenant, subscription, and environment information.
References:
https://docs.microsoft.com/en-us/powershell/module/azurerm.profile/set-azurermcontext
U
R
U
G
SS
PA
A M
EX
Question 333 Topic 1
You have an Azure subscription named Subscription1. Subscription1 contains the resource groups in the following table.
A. The App Service plan for WebApp1 moves to North Europe. Policy2 applies to WebApp1.
B. The App Service plan for WebApp1 remains in West Europe. Policy2 applies to WebApp1.
C. The App Service plan for WebApp1 moves to North Europe. Policy1 applies to WebApp1.
D. The App Service plan for WebApp1 remains in West Europe. Policy1 applies to WebApp1.
Correct Answer: B
You can move an app to another App Service plan, as long as the source plan and the target plan are in the same resource group and
geographical region.
The region in which your app runs is the region of the App Service plan it's in. However, you cannot change an App Service plan's region.
References:
You have an Azure subscription that contains a resource group named RG1. RG1 contains 100 virtual machines.
Your company has three cost centers named Manufacturing, Sales, and Finance.
You need to associate each virtual machine to a specific cost center.
What should you do?
A. Configure locks for the virtual machine.
B. Add an extension to the virtual machines.
C. Assign tags to the virtual machines.
D. Modify the inventory settings of the virtual machine.
Correct Answer: C
References:
https://docs.microsoft.com/en-us/azure/billing/billing-getting-started https://docs.microsoft.com/en-us/azure/azure-resource-
manager/resource-group-using-tags
Solution: From the Subscriptions blade, you select the subscription, and then click Programmatic deployment.
A. Yes
B. No
Correct Answer: B
Solution: From the Subscriptions blade, you select the subscription, and then click Resource providers.
A. Yes
B. No
Correct Answer: B
A. Yes
B. No
Correct Answer: B
AZ-104.examcollection.premium.exam.153q
Number: AZ-104
Passing Score: 800
Time Limit: 120 min
File Version: 3.0
AZ-104
Microsoft Azure Administrator (beta)
Version 3.0
This file was created using VCE Simulator from Avanset.com
1E80AB545CC54BC463A489B460AC4397
Manage Azure identities and governance
Question Set 1
QUESTION 1
Note: This question is part of a series of questions that present the same scenario. Each question in
the series contains a unique solution that might meet the stated goals. Some question sets might have
more than one correct solution, while others might not have a correct solution.
You have an Azure subscription that contains the following users in an Azure Active Directory tenant named
contoso.onmicrosoft.com:
A. Yes
B. No
Correct Answer: A
Section: (none)
Explanation
Explanation/Reference:
Explanation:
Reference:
QUESTION 2
1E80AB545CC54BC463A489B460AC4397
A. Yes
B. No
Correct Answer: B
Section: (none)
Explanation
Explanation:
Reference:
QUESTION 3
1E80AB545CC54BC463A489B460AC4397
A. Yes
B. No
Correct Answer: B
Section: (none)
Explanation
Explanation:
Reference:
QUESTION 4
HOTSPOT
You need to ensure that an administrator named Admin1 can manage LB1 and LB2. The solution must follow
the principle of least privilege.
Which role should you assign to Admin1 for each task? To answer, select the appropriate options in the
answer area.
Hot Area:
Correct Answer:
1E80AB545CC54BC463A489B460AC4397
Section: (none)
Explanation
Explanation:
Reference:
QUESTION 5
You have an Azure subscription that contains an Azure Active Directory (Azure AD) tenant named contoso.com
and an Azure Kubernetes Service (AKS) cluster named AKS1.

C. Recreate AKS1.
Correct Answer: B
Section: (none)
Explanation
Reference:
QUESTION 6
1E80AB545CC54BC463A489B460AC4397
You plan to grant three users named User1, User2, and User3 access to a temporary Microsoft SharePoint
document library named Library1.
You need to create groups for the users. The solution must ensure that the groups are deleted automatically
after 180 days.

Correct Answer: AC
Section: (none)
Explanation
Explanation:
Note: With the increase in usage of Office 365 Groups, administrators and users need a way to clean up
unused groups. Expiration policies can help remove inactive groups from the system and make things cleaner.
When a group expires, all of its associated services (the mailbox, Planner, SharePoint site, etc.) are also
deleted.
Incorrect Answers:
Reference:
https://docs.microsoft.com/en-us/office365/admin/create-groups/office-365-groups-expiration-policy?
view=o365-worldwide
QUESTION 7
HOTSPOT
You have an Azure Active Directory (Azure AD) tenant named contoso.com that contains the users shown in
1E80AB545CC54BC463A489B460AC4397
Hot Area:
1E80AB545CC54BC463A489B460AC4397
Correct Answer:
Section: (none)
Explanation
Reference:
QUESTION 8
HOTSPOT
1E80AB545CC54BC463A489B460AC4397
Hot Area:
Correct Answer:
Section: (none)
Explanation
Explanation:
Box 1: No
1E80AB545CC54BC463A489B460AC4397
Box 2: Yes
Virtual Machines can be created on a Management Group provided the user has the required RBAC
permissions.
Box 3: Yes
Subscriptions can be moved between Management Groups provided the user has the required RBAC
permissions.
Reference:
https://docs.microsoft.com/en-us/azure/governance/management-groups/manage#moving-management-
groups-and-subscriptions
QUESTION 9
Correct Answer: B
1E80AB545CC54BC463A489B460AC4397
Section: (none)
Explanation
Explanation:
You are prevented from creating Azure SQL servers anywhere in Subscription 1 with the exception of
ContosoRG1
QUESTION 10
HOTSPOT
Hot Area:
1E80AB545CC54BC463A489B460AC4397
Correct Answer:
Section: (none)
Explanation
Explanation:

Note: Azure Policy allows you to use either built-in or custom-defined policy definitions and assign them to
either a specific resource group or across a whole Azure subscription.
1E80AB545CC54BC463A489B460AC4397
Incorrect Answers:
RGROUP: RG6
Reference:
QUESTION 11

D. RVAULT1 only
Correct Answer: C
Section: (none)
Explanation
Explanation:
You can now move an Azure Recovery Service (ASR) Vault to either a new resource group within the current
subscription or to a new subscription.
Reference:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/move-resource-group-and-
subscription
QUESTION 12
Admin1 attempts to deploy an Azure Marketplace resource by using an Azure Resource Manager template.
Admin1 deploys the template by using Azure PowerShell and receives the following error message: “User
failed validation to purchase resources. Error message: “Legal terms have not been accepted for this item on
this subscription. To accept legal terms, please go to the Azure portal (http://go.microsoft.com/fwlink/?
LinkId=534873) and configure programmatic deployment for the Marketplace item or create it there for the first
time.”
1E80AB545CC54BC463A489B460AC4397
What should you do?

Correct Answer: C
Section: (none)
Explanation
Reference:
https://docs.microsoft.com/en-us/powershell/module/az.marketplaceordering/set-azmarketplaceterms?
view=azps-4.1.0
QUESTION 13

Correct Answer: B
Section: (none)
Explanation
Explanation:
3. For the selected user, select Directory role, select Add role, and then pick the appropriate admin roles from
the Directory roles list, such as Conditional access administrator.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-users-assign-role-azure-
portal
QUESTION 14
You have an Azure Active Directory (Azure AD) tenant named contoso.onmicrosoft.com that contains 100 user
accounts.
What should you do?
1E80AB545CC54BC463A489B460AC4397
Correct Answer: A
Section: (none)
Explanation
Reference:
QUESTION 15
You have an Azure subscription named Subscription1 and an on-premises deployment of Microsoft System
Center Service Manager.
You need to ensure that an alert is set in Service Manager when the amount of available memory on VM1 is
below 10 percent.

Correct Answer: C
Section: (none)
Explanation
Explanation:
The IT Service Management Connector (ITSMC) allows you to connect Azure and a supported IT Service
Management (ITSM) product/service, such as the Microsoft System Center Service Manager.
With ITSMC, you can create work items in ITSM tool, based on your Azure alerts (metric alerts, Activity Log
alerts and Log Analytics alerts).
Reference:
QUESTION 16
You need to add a user named admin1@contoso.com as an administrator on all the computers that will be
joined to the Azure AD domain.

1E80AB545CC54BC463A489B460AC4397
Correct Answer: A
Section: (none)
Explanation
Explanation:
When you connect a Windows device with Azure AD using an Azure AD join, Azure AD adds the following
security principles to the local administrators group on the device:
In the Azure portal, you can manage the device administrator role on the Devices page. To open the Devices
page:
5. To modify the device administrator role, configure Additional local administrators on Azure AD joined
devices.
Reference:
QUESTION 17
HOTSPOT
Hot Area:
1E80AB545CC54BC463A489B460AC4397
Correct Answer:
Section: (none)
Explanation
Explanation:
Box 1: Yes
Box 2: No
Note: Azure AD registered devices utilize an account managed by the end user, this account is either a
Microsoft account or another locally managed credential.
Box 3: Yes
Reference:
1E80AB545CC54BC463A489B460AC4397
QUESTION 18
RG26 is set to the West Europe location and is used to create temporary resources for a project. RG26
contains the resources shown in the following table.
A. Delete VM1
B. Stop VM1
D. Delete sa001
Correct Answer: C
Section: (none)
Explanation
QUESTION 19
You have an Azure subscription named Subscription1 that contains a virtual network named VNet1. VNet1 is in
a resource group named RG1.
Reader
Security Admin
Security Reader
What should you do?
A. Remove User 1 from the Security Reader role for Subscription1. Assign User1 the Contributor role for RG1.
Correct Answer: B
1E80AB545CC54BC463A489B460AC4397
Section: (none)
Explanation
Explanation:
Reference:
QUESTION 20
A. MX
B. NSEC
C. SRV
D. NSEC3
Correct Answer: A
Section: (none)
Explanation
Reference:
QUESTION 21
You have an Azure Directory (Azure AD) tenant named Adatum and an Azure Subscription named
Subscription1. Adatum contains a group named Developers. Subscription1 contains a resource group named
Dev.
A. Yes
B. No
Correct Answer: B
Section: (none)
Explanation
1E80AB545CC54BC463A489B460AC4397
Explanation:
DevTest Labs User role only lets you connect, start, restart, and shutdown virtual machines in your Azure
DevTest Labs.
The Logic App Contributor role lets you manage logic app, but not access to them. It provides access to view,
edit, and update a logic app.
Reference:
QUESTION 22
Dev.
A. Yes
B. No
Correct Answer: B
Section: (none)
Explanation
Explanation:
Reference:
QUESTION 23
Dev.
1E80AB545CC54BC463A489B460AC4397
A. Yes
B. No
Correct Answer: A
Section: (none)
Explanation
Explanation:
QUESTION 24
DRAG DROP
You have an Azure subscription that is used by four departments in your company. The subscription contains
10 resource groups. Each department uses resources in several resource groups.
You need to send a report to the finance department. The report must detail the costs for each department.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of
Select and Place:
Correct Answer:
1E80AB545CC54BC463A489B460AC4397
Section: (none)
Explanation
Explanation:
You apply tags to your Azure resources giving metadata to logically organize them into a taxonomy. After you
apply tags, you can retrieve all the resources in your subscription with that tag name and value. Each resource
or resource group can have a maximum of 15 tag name/value pairs. Tags applied to the resource group are
not inherited by the resources in that resource group.
After you get your services running, regularly check how much they're costing you. You can see the current
spend and burn rate in Azure portal.

2. Click Cost analysis in the list to the left to see the cost breakdown by resource. Wait 24 hours after you add
a service for the data to populate.
3. You can filter by different properties like tags, resource group, and timespan. Click Apply to confirm the
filters and Download if you want to export the view to a Comma-Separated Values (.csv) file.
Reference:
QUESTION 25
You have an Azure subscription named Subscription1 that contains an Azure Log Analytics workspace named
Workspace1.
A. Get-Event Event | where {$_. EventType == "error"}
1E80AB545CC54BC463A489B460AC4397
C. select * from Event where EnventType == "error"
Correct Answer: B
Section: (none)
Explanation
Reference:
QUESTION 26
HOTSPOT
You have an Azure subscription that contains a virtual network named VNET1 in the East US 2 region.
You have the following resources in an Azure Resource Manager template.
1E80AB545CC54BC463A489B460AC4397
Hot Area:
1E80AB545CC54BC463A489B460AC4397
Correct Answer:
Section: (none)
Explanation
Explanation:
Box 1: Yes
Box 2: Yes
Box 3: No
Reference:
QUESTION 27
You have an Azure subscription named Subscription1. Subscription1 contains the resource groups in the
following table.
1E80AB545CC54BC463A489B460AC4397
Correct Answer: A
Section: (none)
Explanation
Explanation:
You can move an app to another App Service plan, as long as the source plan and the target plan are in the
same resource group and geographical region.
The region in which your app runs is the region of the App Service plan it's in. However, you cannot change an
App Service plan's region.
Reference:
QUESTION 28
HOTSPOT
You have an Azure subscription named Subscription1 that has a subscription ID of c276fc76-9cd4-44c9-99a7-
4fd71546436e.
Can be assigned only to the resource groups in Subscription1

Prevents the management of the access permissions for the resource groups
Allows the viewing, creating, modifying, and deleting of resources within the resource groups
What should you specify in the assignable scopes and the permission elements of the definition of CR1? To
answer, select the appropriate options in the answer area.
Hot Area:
1E80AB545CC54BC463A489B460AC4397
Correct Answer:
1E80AB545CC54BC463A489B460AC4397
Section: (none)
Explanation
Reference:
QUESTION 29
Users access the resources in the subscription from either home or from customer sites. From home, users
must establish a point-to-site VPN to access the Azure resources. The users on the customer sites access the
Azure resources by using site-to-site VPNs.
You have a line-of-business-app named App1 that runs on several Azure virtual machine. The virtual machines
run Windows Server 2016.
What are two possible Azure services that you can use? Each correct answer presents a complete solution.

1E80AB545CC54BC463A489B460AC4397
D. Traffic Manager
Correct Answer: A
Section: (none)
Explanation
Explanation:
Line-of-business apps are custom apps that are used by internal staff members.
QUESTION 30
You need to quickly identify underutilized virtual machines that can have their service tier changed to a less
expensive offering.
A. Monitor
B. Advisor
C. Metrics
Correct Answer: B
Section: (none)
Explanation
Explanation:
Advisor helps you optimize and reduce your overall Azure spend by identifying idle and underutilized resources.
You can get cost recommendations from the Cost tab on the Advisor dashboard.
Reference:
1E80AB545CC54BC463A489B460AC4397
Implement and manage storage
Question Set 1
QUESTION 1
HOTSPOT
You create a Storage Sync Service named Sync1 and an Azure File Sync group named Group1. Group1 uses
share1 as a cloud endpoint.
Hot Area:
Correct Answer:
1E80AB545CC54BC463A489B460AC4397
Section: (none)
Explanation
Explanation:
Box 1: No
A sync group must contain one cloud endpoint, which represents an Azure file share and one or more server
endpoints.
Box 2: Yes
Box 3: Yes
Reference:
QUESTION 2
DRAG DROP
Which UNC path should you include in a script that references files from the data file share? To answer, drag
the appropriate values to the correct targets. Each value may be used once, more than once or not at all. You
Select and Place:
1E80AB545CC54BC463A489B460AC4397
Correct Answer:
Section: (none)
Explanation
Explanation:
The name of account
Box 3: data
Example:
Reference:
QUESTION 3
HOTSPOT
1E80AB545CC54BC463A489B460AC4397
Hot Area:
Correct Answer:
Section: (none)
Explanation
QUESTION 4
HOTSPOT
1E80AB545CC54BC463A489B460AC4397
On which endpoints will File1 and File2 be available within 24 hours of adding the files? To answer, select the
Hot Area:
Correct Answer:
1E80AB545CC54BC463A489B460AC4397
Section: (none)
Explanation
Explanation:

Cloud Tiering: A switch to enable or disable cloud tiering. When enabled, cloud tiering will tier files to your
Azure file shares. This converts on-premises file shares into a cache, rather than a complete copy of the
dataset, to help you manage space efficiency on your server. With cloud tiering, infrequently used or accessed
files can be tiered to Azure Files.
Reference:
QUESTION 5
HOTSPOT
1E80AB545CC54BC463A489B460AC4397
Use the drop-down menus to select the answer choice that completes each statement based on the
information presented in the graphic.
Hot Area:
Correct Answer:
1E80AB545CC54BC463A489B460AC4397
Section: (none)
Explanation
Explanation:
Box 1: always
Box 2: Never
After you configure firewall and virtual network settings for your storage account, select Allow trusted Microsoft
services to access this storage account as an exception to enable Azure Backup service to access the network
restricted storage account.
1E80AB545CC54BC463A489B460AC4397
Reference:
https://azure.microsoft.com/en-us/blog/azure-backup-now-supports-storage-accounts-secured-with-azure-
storage-firewalls-and-virtual-networks/
QUESTION 6
HOTSPOT
You have a sync group named Sync1 that has a cloud endpoint. The cloud endpoint includes a file named
File1.txt.
Your on-premises network contains servers that run Windows Server 2016. The servers are configured as
Hot Area:
Correct Answer:
1E80AB545CC54BC463A489B460AC4397
Section: (none)
Explanation
Explanation:
Box 1: Yes
If you add an Azure file share that has an existing set of files as a cloud endpoint to a sync group, the existing
files are merged with any other files that are already on other endpoints in the sync group.
Box 2: No
Box 3: Yes
Reference:
QUESTION 7
You need to identify which storage account can be converted to zone-redundant storage (ZRS) replication by
requesting a live migration from Azure support.
A. storage1
B. storage2
C. storage3
D. storage4
1E80AB545CC54BC463A489B460AC4397
Correct Answer: B
Section: (none)
Explanation
Explanation:
ZRS currently supports standard general-purpose v2, FileStorage and BlockBlobStorage storage account
types.
Incorrect Answers:
A, not C: Live migration is supported only for storage accounts that use LRS replication. If your account uses
GRS or RA-GRS, then you need to first change your account's replication type to LRS before proceeding. This
intermediary step removes the secondary endpoint provided by GRS/RA-GRS.
Also, only standard storage account types support live migration. Premium storage accounts must be migrated
manually.
D: ZRS currently supports standard general-purpose v2, FileStorage and BlockBlobStorage storage account
types.
Reference:
QUESTION 8
You plan to upload the disk files of a virtual machine to account1 from your on-premises network. The on-
premises network uses a public IP address space of 131.107.1.0/24.
You plan to use the disk files to provision an Azure virtual machine named VM1. VM1 will be attached to a
virtual network named VNet1. VNet1 uses an IP address space of 192.168.0.0/24.
Ensure that you can upload the disk files to account1.

Ensure that you can attach the disks to VM1.
Prevent all other access to account1.
B. From the Firewalls and virtual networks blade of account1, select Allow trusted Microsoft services to
access this storage account.
Correct Answer: AE
Section: (none)
Explanation
Explanation:
A: By default, storage accounts accept connections from clients on any network. To limit access to selected
networks, you must first change the default action.
Azure portal
1E80AB545CC54BC463A489B460AC4397
3. To deny access by default, choose to allow access from 'Selected networks'. To allow traffic from all
networks, choose to allow access from 'All networks'.

By enabling a Service Endpoint for Azure Storage within the Virtual Network, traffic is ensured an optimal route
to the Azure Storage service. The identities of the virtual network and the subnet are also transmitted with each
request.
Reference:
QUESTION 9
DRAG DROP
Select and Place:
Correct Answer:
1E80AB545CC54BC463A489B460AC4397
Section: (none)
Explanation
Explanation:

The Azure File Sync agent is a downloadable package that enables Windows Server to be synced with an
Azure file share

Registering your Windows Server with a Storage Sync Service establishes a trust relationship between your
server (or cluster) and the Storage Sync Service.

A sync group defines the sync topology for a set of files. Endpoints within a sync group are kept in sync with
each other. A sync group must contain one cloud endpoint, which represents an Azure file share and one or
more server endpoints. A server endpoint represents a path on registered server.
Reference:
QUESTION 10
HOTSPOT
Replicates synchronously.
Remains available if a single data center in the region fails.
1E80AB545CC54BC463A489B460AC4397
Hot Area:
Correct Answer:
Section: (none)
Explanation
Explanation:

Zone-redundant storage (ZRS) replicates your data synchronously across three storage clusters in a single
region.

Reference:
QUESTION 11
1E80AB545CC54BC463A489B460AC4397

D. file only
Correct Answer: B
Section: (none)
Explanation
Explanation:
Incorrect Answers:
Reference:
QUESTION 12
HOTSPOT
Which authentication method should you use for each type of storage? To answer, select the appropriate
Hot Area:
1E80AB545CC54BC463A489B460AC4397
Correct Answer:
Section: (none)
Explanation
Explanation:
You can provide authorization credentials by using Azure Active Directory (AD), or by using a Shared Access
Signature (SAS) token.
Box 1:
Box 2:
Reference:
QUESTION 13
You plan to create an Azure container instance named container1 that will use a Docker image named Image1.
Image1 contains a Microsoft SQL Server instance that requires persistent storage.
A. Azure Files
Correct Answer: D
Section: (none)
Explanation
1E80AB545CC54BC463A489B460AC4397
QUESTION 14
You plan to implement an Azure Availability Set for App1. The solution must ensure that App1 is available
during planned maintenance of the hardware hosting VM1 and VM2.

C. one fault domain
Correct Answer: D
Section: (none)
Explanation
Explanation:
Microsoft updates, which Microsoft refers to as planned maintenance events, sometimes require that VMs be
rebooted to complete the update. To reduce the impact on VMs, the Azure fabric is divided into update
domains to ensure that not all VMs are rebooted at the same time.
Incorrect Answers:
A: An update domain is a group of VMs and underlying physical hardware that can be rebooted at the same
time.
B, C: A fault domain shares common storage as well as a common power source and network switch. It is
used to protect against unplanned system failure.
References:
QUESTION 15
HOTSPOT
1E80AB545CC54BC463A489B460AC4397
Which storage accounts and which Log Analytics workspaces can you use for the Azure Backup reports of
Vault1? To answer, select the appropriate options in the answer area.
Hot Area:
Correct Answer:
Section: (none)
Explanation
Explanation:

Box 2: Analytics3
Reference:
1E80AB545CC54BC463A489B460AC4397
QUESTION 16
HOTSPOT
Hot Area:
1E80AB545CC54BC463A489B460AC4397
Correct Answer:
Section: (none)
Explanation
Explanation:


Reference:
https://docs.microsoft.com/en-us/azure/storage/common/storage-dotnet-shared-access-signature-part-1
https://docs.microsoft.com/en-us/azure/vs-azure-tools-storage-manage-with-storage-explorer?tabs=windows
QUESTION 17
You need to copy the contents of D:\Folder1 to the public container in an Azure Storage account named
contosodata.
1E80AB545CC54BC463A489B460AC4397
B. azcopy sync D:\folder1 https://contosodata.blob.core.windows.net/public --
snapshot
C. azcopy copy D:\folder1 https://contosodata.blob.core.windows.net/public --
recursive
D. az storage blob copy start-batch D:\Folder1 https://
contosodata.blob.core.windows.net/public
Correct Answer: C
Section: (none)
Explanation
Explanation:
The azcopy copy command copies a directory (and all of the files in that directory) to a blob container. The
result is a directory in the container by the same name.
Incorrect Answers:
B: The azcopy sync command replicates the source location to the destination location. However, the file is
skipped if the last modified time in the destination is more recent.
Reference:
QUESTION 18
You have an Azure subscription named Subscription1 that contains the storage accounts shown in the
following table:
A. storage1
B. storage2
C. storage3
D. storage4
Correct Answer: D
Section: (none)
Explanation
Explanation:
1E80AB545CC54BC463A489B460AC4397

Reference:
QUESTION 19
HOTSPOT
Hot Area:
Correct Answer:
1E80AB545CC54BC463A489B460AC4397
Section: (none)
Explanation
Explanation:
Note: The three different storage account options are: General-purpose v2 (GPv2) accounts, General-purpose
v1 (GPv1) accounts, and Blob storage accounts.
General-purpose v2 (GPv2) accounts are storage accounts that support all of the latest features for blobs,
files, queues, and tables.
Blob storage accounts support all the same block blob features as GPv2, but are limited to supporting only
block blobs.
General-purpose v1 (GPv1) accounts provide access to all Azure Storage services, but may not have the
latest features or the lowest per gigabyte pricing.
Reference:
QUESTION 20
A. DB1
1E80AB545CC54BC463A489B460AC4397
B. container1
C. Share1
D. Table1
Correct Answer: C
Section: (none)
Explanation
Explanation:
Azure Import/Export service is used to securely import large amounts of data to Azure Blob storage and Azure
Files by shipping disk drives to an Azure datacenter.
Reference:
QUESTION 21
HOTSPOT
You have an Azure Service app named App1 and an app named App2 that runs in an Azure container
instance. Each app uses a managed identity.
You need to ensure that App1 and App2 can read blobs from storage1. The solution must meet the following
requirements:
Minimize the number of secrets used.

Ensure that App2 can only read from storage1 for the next 30 days.
What should you configure in storage1 for each app? To answer, select the appropriate options in the answer
area.
Hot Area:
1E80AB545CC54BC463A489B460AC4397
Correct Answer:
Section: (none)
Explanation
Explanation:
App1: Access keys

A shared access signature (SAS) provides secure delegated access to resources in your storage account
1E80AB545CC54BC463A489B460AC4397
without compromising the security of your data. With a SAS, you have granular control over how a client can
access your data. You can control what resources the client may access, what permissions they have on those
resources, and how long the SAS is valid, among other parameters.
Reference:
QUESTION 22
HOTSPOT
Minimizes costs
Supports hot, cool, and archive blob tiers
Provides fault tolerance if a disaster affects the Azure region where the account resides
How should you complete the command? To answer, select the appropriate options in the answer area.
Hot Area:
Correct Answer:
Section: (none)
Explanation
Explanation:
1E80AB545CC54BC463A489B460AC4397
Box 1: StorageV2
You may only tier your object storage data to hot, cool, or archive in Blob storage and General Purpose v2
(GPv2) accounts. General Purpose v1 (GPv1) accounts do not support tiering.
General-purpose v2 accounts deliver the lowest per-gigabyte capacity prices for Azure Storage, as well as
industry-competitive transaction prices.
Box 2: Standard_GRS
Geo-redundant storage (GRS): Cross-regional replication to protect against region-wide unavailability.
Incorrect Answers:
Locally-redundant storage (LRS): A simple, low-cost replication strategy. Data is replicated within a single
storage scale unit.
Read-access geo-redundant storage (RA-GRS): Cross-regional replication with read access to the replica. RA-
GRS provides read-only access to the data in the secondary location, in addition to geo-replication across two
regions, but is more expensive compared to GRS.
Reference:
QUESTION 23
You need to synchronize the files in the file share named data to an on-premises server named Server1.

B. Register Server1
Correct Answer: BCE

Section: (none)
Explanation
Explanation:
Azure file share
1E80AB545CC54BC463A489B460AC4397

Reference:
QUESTION 24
HOTSPOT
1E80AB545CC54BC463A489B460AC4397
Hot Area:
1E80AB545CC54BC463A489B460AC4397
Correct Answer:
Section: (none)
Explanation
QUESTION 25
DRAG DROP
You have an on-premises server named Server1 that runs Windows Server 2016. Server1 has 2 TB of data.
In which order should you perform the actions? To answer, move all actions from the list of actions to the
answer area and arrange them in the correct order.
NOTE: More than one order of answer choices is correct. You will receive credit for any of the correct orders
you select.
Select and Place:
1E80AB545CC54BC463A489B460AC4397
Correct Answer:
Section: (none)
Explanation
Explanation:

Determine data to be imported, number of drives you need, destination blob location for your data in Azure
storage.


Reference:
1E80AB545CC54BC463A489B460AC4397
Testlet 2
Case study
This is a case study. Case studies are not timed separately. You can use as much exam time as you
would like to complete each case. However, there may be additional case studies and sections on this
exam. You must manage your time to ensure that you are able to complete all questions included on this exam
in the time provided.
To answer the questions included in a case study, you will need to reference information that is provided in the
case study. Case studies might contain exhibits and other resources that provide more information about the
scenario that is described in the case study. Each question is independent of the other questions in this case
study.
At the end of this case study, a review screen will appear. This screen allows you to review your answers and
to make changes before you move to the next section of the exam. After you begin a new section, you cannot
return to this section.
To start the case study

To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore
the content of the case study before you answer the questions. Clicking these buttons displays information
such as business requirements, existing environment, and problem statements. If the case study has an All
Information tab, note that the information displayed is identical to the information displayed on the subsequent
tabs. When you are ready to answer a question, click the Question button to return to the question.
Overview
File servers
Domain controllers
Your network contains an Active Directory forest named contoso.com. All servers and client computers are
joined to Active Directory.
A SQL database
A web front end
Requirements
Planned Changes
1E80AB545CC54BC463A489B460AC4397
Create a hybrid directory to support an upcoming Microsoft Office 365 migration project.

Ensure that when users join devices to Azure Active Directory (Azure AD), the users use a mobile phone to
verify their identity.
User Requirements
QUESTION 1
A. a recovery plan
C. a backup policy
Correct Answer: D
Section: (none)
Explanation
Explanation:
A Recovery Services vault is a logical container that stores the backup data for each protected resource, such
as Azure VMs. When the backup job for a protected resource runs, it creates a recovery point inside the
Recovery Services vault.
Scenario:
Reference:
QUESTION 2
1E80AB545CC54BC463A489B460AC4397
What should you do?
Correct Answer: B
Section: (none)
Explanation
Explanation:
Azure Storage Explorer is a free tool from Microsoft that allows you to work with Azure Storage data on
Windows, macOS, and Linux. You can use it to upload and download data from Azure blob storage.
Scenario:
Reference:
https://docs.microsoft.com/en-us/azure/machine-learning/team-data-science-process/move-data-to-azure-blob-
using-azure-storage-explorer
QUESTION 3
HOTSPOT
Hot Area:
Correct Answer:
1E80AB545CC54BC463A489B460AC4397
Section: (none)
Explanation
Explanation:
Box 1: Yes
Box 2: No
Box 3: No
1E80AB545CC54BC463A489B460AC4397
Deploy and manage Azure compute resources
Question Set 1
QUESTION 1
A. Yes
B. No
Correct Answer: B
Section: (none)
Explanation
Explanation:
Note: When you create an Azure virtual machine (VM), you must create a virtual network (VNet) or use an
existing VNet. You can change the subnet a VM is connected to after it's created, but you cannot change the
VNet.
Reference:
QUESTION 2
1E80AB545CC54BC463A489B460AC4397
Solution: You delete VM1. You recreate VM1, and then you create a new network interface for VM1 and
connect it to VNET2.
A. Yes
B. No
Correct Answer: A
Section: (none)
Explanation
Explanation:
VNet.
Reference:
QUESTION 3
1E80AB545CC54BC463A489B460AC4397
A. Yes
B. No
Correct Answer: B
Section: (none)
Explanation
Explanation:
VNet.
Reference:
QUESTION 4
HOTSPOT
1E80AB545CC54BC463A489B460AC4397
Hot Area:
Correct Answer:
Section: (none)
Explanation
1E80AB545CC54BC463A489B460AC4397
Explanation:
The total regional vCPUs is 20 so that means a maximum total of 20 vCPUs across all the different VM sizes.
The deallocated VM with 16 vCPUs counts towards the total. VM20 and VM1 are using 18 of the maximum 20
vCPUs leaving only two vCPUs available.
Reference:
QUESTION 5
HOTSPOT
You have an Azure subscription that contains an Azure Availability Set named WEBPROD-AS-USE2 as shown
in the following exhibit.
Hot Area:
1E80AB545CC54BC463A489B460AC4397
Correct Answer:
Section: (none)
Explanation
Explanation:
Box 1: 2
There are 10 update domains. The 14 VMs are shared across the 10 update domains so four update domains
will have two VMs and six update domains will have one VM. Only one update domain is rebooted at a time.
Therefore, a maximum of two VMs will be offline.
Box 2: 7
There are 2 fault domains. The 14 VMs are shared across the 2 fault domains, so 7 VMs in each fault domain.
A rack failure will affect one fault domain so 7 VMs will be offline.
Reference:
1E80AB545CC54BC463A489B460AC4397
QUESTION 6
You deploy an Azure Kubernetes Service (AKS) cluster named Cluster1 that uses the IP addresses shown in
A. 131.107.2.1
B. 10.0.10.11
C. 172.17.7.1
D. 192.168.10.2
Correct Answer: A
Section: (none)
Explanation
QUESTION 7

Correct Answer: B
Section: (none)
Explanation
Explanation:
Reference:
QUESTION 8
HOTSPOT
1E80AB545CC54BC463A489B460AC4397
information presented in the template.
Hot Area:
1E80AB545CC54BC463A489B460AC4397
Correct Answer:
Section: (none)
Explanation
QUESTION 9
You have an Azure subscription that contains a virtual machine named VM1. VM1 hosts a line-of-business
application that is available 24 hours a day. VM1 has one network interface and one managed disk. VM1 uses
the D4s v3 size.

Enable Desired State Configuration Management.

Correct Answer: C
Section: (none)
Explanation
1E80AB545CC54BC463A489B460AC4397
Explanation:
Reference:
QUESTION 10
A. Swap the slots

Correct Answer: AD
Section: (none)
Explanation
QUESTION 11
Authorization
Automation
Resources
Compute
KeyVault
Network
Storage
Billing
Web

Subnet: 10.0.0.0/24
Managed disks: No
1E80AB545CC54BC463A489B460AC4397
Location: East US

Correct Answer: ACD

Section: (none)
Explanation
Explanation:
D: NSG flow log data is written to an Azure Storage account. You need to create an Azure Storage account,
Reference:
QUESTION 12
What should you do?
Correct Answer: D
Section: (none)
Explanation
Reference:
QUESTION 13
1E80AB545CC54BC463A489B460AC4397
A. 1
B. 2
C. 3
D. 4
Correct Answer: A
Section: (none)
Explanation
QUESTION 14
HOTSPOT
1E80AB545CC54BC463A489B460AC4397
Hot Area:
1E80AB545CC54BC463A489B460AC4397
Correct Answer:
Section: (none)
Explanation
Explanation:


Budget alerts for Resource Group RG1, which include VM1, but not VM2.VM1 consumes 20 Euro/day. The
50%, 500 Euro limit, will be reached in 25 days, and an email will be sent.
The 70% and 100% alert conditions will not be reached within a month, and they don't trigger email actions
anyway.
Credit alerts: Credit alerts are generated automatically at 90% and at 100% of your Azure credit balance.
Whenever an alert is generated, it's reflected in cost alerts and in the email sent to the account owners. 90%
and 100% will not be reached though.
Reference:
QUESTION 15
1E80AB545CC54BC463A489B460AC4397
You have an Azure subscription named Subscription1. Subscription1 contains a resource group named RG1.
RG1 contains resources that were deployed by using templates.
deployment.
A. Yes
B. No
Correct Answer: B
Section: (none)
Explanation
Explanation:
Reference:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/template-tutorial-create-first-
template?tabs=azure-powershell
QUESTION 16
A. Yes
B. No
Correct Answer: B
Section: (none)
Explanation
Explanation:
1E80AB545CC54BC463A489B460AC4397
Reference:
QUESTION 17
A. Yes
B. No
Correct Answer: A
Section: (none)
Explanation
Explanation:
Reference:
QUESTION 18
A. Azure HDInsight
Correct Answer: C
Section: (none)
Explanation
Explanation:
1E80AB545CC54BC463A489B460AC4397
The basic host metrics are available, but to see more granular and VM-specific metrics, you need to install the
Azure diagnostics extension on the VM. The Azure diagnostics extension allows additional monitoring and
diagnostics data to be retrieved from the VM.
Reference:
QUESTION 19
HOTSPOT
Hot Area:
1E80AB545CC54BC463A489B460AC4397
Correct Answer:
Section: (none)
Explanation
QUESTION 20
You plan to deploy three Azure virtual machines named VM1, VM2, and VM3. The virtual machines will host a
web app named App1.
You need to ensure that at least two virtual machines are available if a single Azure datacenter becomes
unavailable.

Correct Answer: B
Section: (none)
Explanation
1E80AB545CC54BC463A489B460AC4397
Explanation:
Availability sets are a datacenter configuration to provide VM redundancy and availability. This configuration
within a datacenter ensures that during either a planned or unplanned maintenance event, at least one virtual
machine is available.
Reference:
QUESTION 21
A. operating system
D. resource group
Correct Answer: B
Section: (none)
Explanation
Explanation:
the Resource Group name and location for the VM
the administrator username and password
an unique DNS name for the public IP
Reference:
QUESTION 22
You have an Azure subscription that contains an Azure virtual machine named VM1. VM1 runs a financial
reporting app named App1 that does not support multiple active instances.
You need to create a scheduled runbook to increase the processor performance of VM1 at the end of each
month.

Correct Answer: E
1E80AB545CC54BC463A489B460AC4397
Section: (none)
Explanation
Reference:
QUESTION 23
Create files on drive C.

Create files on drive D.
Modify the screen saver timeout.
Change the desktop background.

Correct Answer: A
Section: (none)
Explanation
QUESTION 24
You have an on-premises virtual machine named VM1. The settings for VM1 are shown in the exhibit. (Click
the Exhibit tab.)
1E80AB545CC54BC463A489B460AC4397
A. the memory
C. the hard drive
D. the processor
Correct Answer: C
Section: (none)
Explanation
Explanation:
Before you upload a Windows virtual machine (VM) from on-premises to Microsoft Azure, you must prepare
1E80AB545CC54BC463A489B460AC4397
the virtual hard disk (VHD or VHDX). Azure supports only generation 1 VMs that are in the VHD file format and
have a fixed sized disk. The maximum size allowed for the VHD is 1,023 GB. You can convert a generation 1
VM from the VHDX file system to VHD and from a dynamically expanding disk to fixed-sized.
Reference:
QUESTION 25
HOTSPOT
You have an Azure subscription that contains a virtual machine scale set. The scale set contains four instances
that have the following configurations:
Operating system: Windows Server 2016

Size: Standard_D1_v2
Hot Area:
1E80AB545CC54BC463A489B460AC4397
Correct Answer:
Section: (none)
Explanation
Explanation:
The Get-AzVmssVM cmdlet gets the model view and instance view of a Virtual Machine Scale Set (VMSS)
virtual machine.
Box 1: 0
The enableAutomaticUpdates parameter is set to false. To update existing VMs, you must do a manual
upgrade of each existing VM.
Box 2: 4
1E80AB545CC54BC463A489B460AC4397
Enabling automatic OS image upgrades on your scale set helps ease update management by safely and
automatically upgrading the OS disk for all instances in the scale set.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-upgrade-scale-
set
https://docs.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-automatic-
upgrade
QUESTION 26
You have an Azure subscription named Subscription1 that is used by several departments at your company.
Subscription1 contains the resources in the following table:
Another administrator deploys a virtual machine named VM1 and an Azure Storage account named storage2
by using a single Azure Resource Manager template.
A. VM1
B. RG1
C. storage2
D. container1
Correct Answer: B
Section: (none)
Explanation
Explanation:
1. Go to the resource group for your new resource group. Notice that the portal shows the result of the last
deployment. Select this link.
2. You see a history of deployments for the group. In your case, the portal probably lists only one deployment.
1E80AB545CC54BC463A489B460AC4397
Select this deployment.
3. The portal displays a summary of the deployment. The summary includes the status of the deployment and
its operations and the values that you provided for parameters. To see the template that you used for the
deployment, select View template.
Reference:
QUESTION 27
1E80AB545CC54BC463A489B460AC4397
You back up App1.
What should you do?
A. Redeploy App1
B. Swap the slots
C. Clone App1
Correct Answer: B
Section: (none)
Explanation
Explanation:
When you swap deployment slots, Azure swaps the Virtual IP addresses of the source and destination slots,
thereby swapping the URLs of the slots. We can easily revert the deployment by swapping back.
Reference:
QUESTION 28
HOTSPOT
You have an Azure subscription named Subscription1. Subscription1 contains two Azure virtual machines VM1
and VM2. VM1 and VM2 run Windows Server 2016.
Hot Area:
1E80AB545CC54BC463A489B460AC4397
Correct Answer:
Section: (none)
Explanation
Explanation:
Reference:
QUESTION 29
1E80AB545CC54BC463A489B460AC4397
You need to create an alert in Azure when more than two error events are logged to the System event log on
VM1 within an hour.
Solution: You create an Azure Log Analytics workspace and configure the data settings. You add the Microsoft
Monitoring Agent VM extension to VM1. You create an alert in Azure Monitor and specify the Log Analytics
workspace as the source.
A. Yes
B. No
Correct Answer: B
Section: (none)
Explanation
Explanation:
Instead: You create an Azure Log Analytics workspace and configure the data settings. You install the
Microsoft Monitoring Agent on VM1. You create an alert in Azure Monitor and specify the Log Analytics
Reference:
QUESTION 30
VM1 within an hour.
Solution: You create an Azure Log Analytics workspace and configure the data settings. You install the
A. Yes
B. No
Correct Answer: A
Section: (none)
Explanation
Explanation:
Alerts in Azure Monitor can identify important information in your Log Analytics repository. They are created by
1E80AB545CC54BC463A489B460AC4397
alert rules that automatically run log searches at regular intervals, and if results of the log search match
particular criteria, then an alert record is created and it can be configured to perform an automated response.
The Log Analytics agent collects monitoring data from the guest operating system and workloads of virtual
machines in Azure, other cloud providers, and on-premises. It collects data into a Log Analytics workspace.
Reference:
QUESTION 31
VM1 within an hour.
Solution: You create an Azure storage account and configure shared access signatures (SASs). You install the
Microsoft Monitoring Agent on VM1. You create an alert in Azure Monitor and specify the storage account as
the source.
A. Yes
B. No
Correct Answer: B
Section: (none)
Explanation
Explanation:
Reference:
QUESTION 32
HOTSPOT
You have an Azure subscription named Subscription1. Subscription1 contains the resources in the following
table.
1E80AB545CC54BC463A489B460AC4397
An administrator named Admin1 creates an Azure virtual machine named VM1 in RG1. VM1 uses a disk
named Disk1 and connects to VNet1. Admin1 then installs a custom application in VM1.
You need to move the custom application to VNet2. The solution must minimize administrative effort.
Which two actions should you perform? To answer, select the appropriate options in the answer area.
Hot Area:
Correct Answer:
1E80AB545CC54BC463A489B460AC4397
Section: (none)
Explanation
Explanation:
We cannot just move a virtual machine between networks. What we need to do is identify the disk used by the
VM, delete the VM itself while retaining the disk, and recreate the VM in the target virtual network and then
attach the original disk to it.
Reference:
https://blogs.technet.microsoft.com/canitpro/2014/06/16/step-by-step-move-a-vm-to-a-different-vnet-on-azure/
https://4sysops.com/archives/move-an-azure-vm-to-another-virtual-network-vnet/#migrate-an-azure-vm-
between-vnets
QUESTION 33
You download an Azure Resource Manager template based on an existing virtual machine. The template will
be used to deploy 100 virtual machines.
You need to modify the template to reference an administrative password. You must prevent the password
from being stored in plain text.

1E80AB545CC54BC463A489B460AC4397
Correct Answer: A
Section: (none)
Explanation
Explanation:
You can use a template that allows you to deploy a simple Windows VM by retrieving the password that is
stored in a Key Vault. Therefore, the password is never put in plain text in the template parameter file.
Reference:
QUESTION 34
HOTSPOT
Hot Area:
1E80AB545CC54BC463A489B460AC4397
Correct Answer:
Section: (none)
Explanation
Explanation:
1E80AB545CC54BC463A489B460AC4397
Box 1: ASP1 ASP3
Box 2: ASP1
Reference:
QUESTION 35
HOTSPOT
You create a virtual machine scale set named Scale1. Scale1 is configured as shown in the following exhibit.
1E80AB545CC54BC463A489B460AC4397
Hot Area:
Correct Answer:
Section: (none)
Explanation
Explanation:
Box 1: 6 virtual machines

The Autoscale scale out rule increases the number of VMs by 2 if the CPU threshold is 80% or higher. The
1E80AB545CC54BC463A489B460AC4397
initial instance count is 4 and rises to 6 when the 2 extra instances of VMs are added.
Box 2: 2 virtual machnes

The Autoscale scale in rule decreases the number of VMs by 4 if the CPU threshold is 30% or lower. The initial
instance count is 4 and thus cannot be reduced to 0 as the minimum instances is set to 2. Instances are only
added when the CPU threshold reaches 80%.
Reference:
QUESTION 36
You plan to automate the deployment of a virtual machine scale set that uses the Windows Server 2016
Datacenter image.
You need to ensure that when the scale set virtual machines are provisioned, they have web server
components installed.

E. Create a new virtual scale set in the Azure portal
Correct Answer: DE
Section: (none)
Explanation
Explanation:
Virtual Machine Scale Sets can be used with the Azure Desired State Configuration (DSC) extension handler.
Virtual machine scale sets provide a way to deploy and manage large numbers of virtual machines, and can
elastically scale in and out in response to load. DSC is used to configure the VMs as they come online so they
are running the production software.
Reference:
QUESTION 37
HOTSPOT
You have an Azure Kubernetes Service (AKS) cluster named AKS1 and a computer named Computer1 that
runs Windows 10. Computer1 that has the Azure CLI installed.
Hot Area:
1E80AB545CC54BC463A489B460AC4397
Correct Answer:
Section: (none)
Explanation
Explanation:
To install kubectl locally, use the az aks install-cli command:
az aks install-cli
Reference:
QUESTION 38
DRAG DROP
You need to use Azure Automation State Configuration to manage the ongoing consistency of the virtual
machine configurations.
NOTE: More than one order of answer choices is correct. You will receive credit for any of the correct orders
you select.
Select and Place:
1E80AB545CC54BC463A489B460AC4397
Correct Answer:
Section: (none)
Explanation
Explanation:


A DSC configuration defining that state must be compiled into one or more node configurations (MOF
document), and placed on the Automation DSC Pull Server.

Each time Azure Automation State Configuration performs a consistency check on a managed node, the node
sends a status report back to the pull server. You can view these reports on the page for that node.
On the blade for an individual report, you can see the following status information for the corresponding
consistency check:
1E80AB545CC54BC463A489B460AC4397
The report status — whether the node is "Compliant", the configuration "Failed", or the node is "Not Compliant"
Reference:
QUESTION 39
You have an Azure Resource Manager template named Template1 that is used to deploy an Azure virtual
machine.
What should you do?
A. Modify the location in the resource section to westus

Correct Answer: A
Section: (none)
Explanation
QUESTION 40
1E80AB545CC54BC463A489B460AC4397

Correct Answer: A
Section: (none)
Explanation
Explanation:
The app must be running in the Standard, Premium, or Isolated tier in order for you to enable multiple
deployment slots.
If the app isn't already in the Standard, Premium, or Isolated tier, you receive a message that indicates the
supported tiers for enabling staged publishing. At this point, you have the option to select Upgrade and go to
the Scale tab of your app before continuing.
Scale up: Get more CPU, memory, disk space, and extra features like dedicated virtual machines (VMs),
custom domains and certificates, staging slots, autoscaling, and more.
Incorrect:
Scale out: Increase the number of VM instances that run your app. You can scale out to as many as 30
instances
Reference:
QUESTION 41
You need to ensure that App1 always runs on at least eight virtual machines during planned Azure
maintenance.
Correct Answer: C
Section: (none)
Explanation
Explanation:
An update domain is a logical group of underlying hardware that can undergo maintenance or be rebooted at
the same time. As you create VMs within an availability set, the Azure platform automatically distributes your
1E80AB545CC54BC463A489B460AC4397
VMs across these update domains. This approach ensures that at least one instance of your application always
remains running as the Azure platform undergoes periodic maintenance.
Reference:
QUESTION 42
VM1 within an hour.
Solution: You create an event subscription on VM1. You create an alert in Azure Monitor and specify VM1 as
the source
A. Yes
B. No
Correct Answer: B
Section: (none)
Explanation
Explanation:
Reference:
QUESTION 43
You have an Azure virtual machine named VM1. VM1 was deployed by using a custom Azure Resource
Manager template named ARM1.json.
1E80AB545CC54BC463A489B460AC4397
A. Yes
B. No
Correct Answer: B
Section: (none)
Explanation
Explanation:
Reference:
QUESTION 44
A. Yes
B. No
Correct Answer: A
Section: (none)
Explanation
Explanation:
When you redeploy a VM, it moves the VM to a new node within the Azure infrastructure and then powers it
back on, retaining all your configuration options and associated resources.
References:
QUESTION 45
1E80AB545CC54BC463A489B460AC4397
A. Yes
B. No
Correct Answer: B
Section: (none)
Explanation
Explanation:
Reference:
1E80AB545CC54BC463A489B460AC4397
Testlet 2
Case study
study.

Overview
Litware, Inc. is a consulting company that has a main office in Montreal and two branch offices in Seattle and
New York.
The Montreal office has 2,000 employees. The Seattle office has 1,000 employees. The New York office has
200 employees.
Litware creates a new Azure subscription. The Azure Active Directory (Azure AD) tenant uses a domain named
litware.onmicrosoft.com. The tenant uses the P1 pricing tier.
The network contains an Active Directory forest named litware.com. All domain controllers are configured as
DNS servers and host the litware.com DNS zone.
Litware has finance, human resources, sales, research, and information technology departments. Each
department has an organizational unit (OU) that contains all the accounts of that respective department. All the
user accounts have the department attribute set to their respective department. New users are added
frequently.
Litware has data centers in the Montreal and Seattle offices. Each office has a firewall that can be configured
as a VPN device.
All infrastructure servers are virtualized. The virtualization environment contains the servers in the following
table.
1E80AB545CC54BC463A489B460AC4397
Litware uses two web applications named App1 and App2. Each instance on each web application requires 1
GB of memory.
Requirements
Planned Changes

Ensure that WebApp1 can adjust the number of instances automatically based on the load and can scale
up to five instances.
Ensure that VM3 can establish outbound connections over TCP port 8080 to the applications servers in the
Montreal office.
Ensure that routing information is exchanged automatically between Azure and the routers in the Montreal
office.
QUESTION 1
A. Diagram in VNet1
B. Diagnostic settings in Azure Monitor
1E80AB545CC54BC463A489B460AC4397
C. Diagnose and solve problems in Traffic Manager profiles
D. The security recommendations in Azure Advisor
Correct Answer: E
Section: (none)
Explanation
Explanation:
Montreal office.
IP flow verify checks if a packet is allowed or denied to or from a virtual machine. The information consists of
direction, protocol, local IP, remote IP, local port, and remote port. If the packet is denied by a security group,
the name of the rule that denied the packet is returned. While any source or destination IP can be chosen, IP
flow verify helps administrators quickly diagnose connectivity issues from or to the internet and from or to the
on-premises environment.
Reference:
1E80AB545CC54BC463A489B460AC4397
Configure and manage virtual networking
Question Set 1
QUESTION 1
You have an Azure subscription that contains 10 virtual networks. The virtual networks are hosted in separate
resource groups.
You need to ensure that when an NSG is created, it automatically blocks TCP port 8080 between the virtual
networks.
A. Yes
B. No
Correct Answer: B
Section: (none)
Explanation
Explanation:
Resource policy definition used by Azure Policy enables you to establish conventions for resources in your
organization by describing when the policy is enforced and what effect to take. By defining conventions, you
can control costs and more easily manage your resources.
Reference:
QUESTION 2
resource groups.
networks.
1E80AB545CC54BC463A489B460AC4397
A. Yes
B. No
Correct Answer: B
Section: (none)
Explanation
Explanation:
Reference:
QUESTION 3
resource groups.
networks.
A. Yes
B. No
Correct Answer: A
Section: (none)
Explanation
Explanation:
Reference:
QUESTION 4
You have two Azure virtual networks named VNet1 and VNet2. VNet1 contains an Azure virtual machine
named VM1. VNet2 contains an Azure virtual machine named VM2.
1E80AB545CC54BC463A489B460AC4397
A. IP flow verify
D. NSG flow logs
Correct Answer: C
Section: (none)
Explanation
Explanation:
The connection monitor capability monitors communication at a regular interval and informs you of reachability,
latency, and network topology changes between the VM and the endpoint
Incorrect Answers:
A: The IP flow verify capability enables you to specify a source and destination IPv4 address, port, protocol
(TCP or UDP), and traffic direction (inbound or outbound). IP flow verify then tests the communication and
informs you if the connection succeeds or fails. If the connection fails, IP flow verify tells you which security rule
allowed or denied the communication, so that you can resolve the problem.
B: The connection troubleshoot capability enables you to test a connection between a VM and another VM, an
FQDN, a URI, or an IPv4 address. The test returns similar information returned when using the connection
monitor capability, but tests the connection at a point in time, rather than monitoring it over time, as connection
monitor does.
D: The NSG flow log capability allows you to log the source and destination IP address, port, protocol, and
whether traffic was allowed or denied by an NSG.
Reference:
QUESTION 5
You have an Azure subscription that contains a policy-based virtual network gateway named GW1 and a virtual
network named VNet1.

B. Reset GW1
E. Delete GW1
1E80AB545CC54BC463A489B460AC4397
Correct Answer: CE
Section: (none)
Explanation
Explanation:
Route-based VPN devices use any-to-any (wildcard) traffic selectors, and let routing/forwarding tables direct
traffic to different IPsec tunnels. It is typically built on router platforms where each IPsec tunnel is modeled as a
network interface or VTI (virtual tunnel interface).
E: Policy-based VPN devices use the combinations of prefixes from both networks to define how traffic is
encrypted/decrypted through IPsec tunnels. It is typically built on firewall devices that perform packet filtering.
IPsec tunnel encryption and decryption are added to the packet filtering and processing engine.
Incorrect Answers:
Reference:
https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-connect-multiple-policybased-rm-ps
QUESTION 6
HOTSPOT
In Azure, you create a private DNS zone named adatum.com. You set the registration virtual network to VNet2.
The adatum.com zone is configured as shown in the following exhibit:
1E80AB545CC54BC463A489B460AC4397
Hot Area:
Correct Answer:
1E80AB545CC54BC463A489B460AC4397
Section: (none)
Explanation
Explanation:
Box 1: No
Azure DNS provides automatic registration of virtual machines from a single virtual network that's linked to a
private zone as a registration virtual network. VM5 does not belong to the registration virtual network though.
Box 2: No
Forward DNS resolution is supported across virtual networks that are linked to the private zone as resolution
virtual networks. VM5 does belong to a resolution virtual network.
Box 3: Yes
By default, registration virtual networks also act as resolution virtual networks, in the sense that DNS resolution
against the zone works from any of the virtual machines within the registration virtual network.
Reference:
QUESTION 7
HOTSPOT
You have an Azure subscription that contains a virtual network named VNet1. VNet1 uses an IP address space
of 10.0.0.0/16 and contains the subnets in the following table:
1E80AB545CC54BC463A489B460AC4397
Hot Area:
Correct Answer:
1E80AB545CC54BC463A489B460AC4397
Section: (none)
Explanation
QUESTION 8
You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as
web servers.

C. Protocol to UDP
Correct Answer: D
Section: (none)
Explanation
Explanation:
1E80AB545CC54BC463A489B460AC4397
With Sticky Sessions when a client starts a session on one of your web servers, session stays on that specific
server. To configure An Azure Load-Balancer For Sticky Sessions set Session persistence to Client IP.
Reference:
QUESTION 9
HOTSPOT
VM1 and VM2 use public IP addresses. From Windows Server 2019 on VM1 and VM2, you allow inbound
Remote Desktop connections.
The subscription contains two network security groups (NSGs) named NSG1 and NSG2. NSG1 uses only the
default rules.
Priority: 100
Name: Rule1
Port: 3389
Protocol: TCP
Source: Any
Destination: Any
Action: Allow
1E80AB545CC54BC463A489B460AC4397
Hot Area:
Correct Answer:
Section: (none)
Explanation
QUESTION 10
HOTSPOT
You have two Azure virtual machines that have the network configurations shown in the following table:
1E80AB545CC54BC463A489B460AC4397
Hot Area:
Correct Answer:
Section: (none)
Explanation
1E80AB545CC54BC463A489B460AC4397
Explanation:
Box 1: Yes
The inbound security rule for NSG1 allows TCP port 1433 from 10.10.2.0/24 (or Subnet2 where VM2 and VM3
are located) to 10.10.1.0/24 (or Subnet1 where VM1 is located) while the inbound security rule for NSG2 blocks
TCP port 1433 from 10.10.2.5 (or VM2) to 10.10.1.5 (or VM1). However, the NSG1 rule has a higher priority (or
lower value) than the NSG2 rule.
Box 2: Yes
No rule explicitly blocks communication from VM1. The default rules, which allow communication, are thus
applied.
Box 3: Yes
No rule explicitly blocks communication between VM2 and VM3 which are both on Subnet2. The default rules,
which allow communication, are thus applied.
Reference:
QUESTION 11
HOTSPOT
VM3 has multiple network adapters, including a network adapter named NIC3. IP forwarding is enabled on
NIC3. Routing is enabled on VM3.
1E80AB545CC54BC463A489B460AC4397
Hot Area:
Correct Answer:
Section: (none)
Explanation
Explanation:
Receive network traffic not destined for one of the IP addresses assigned to any of the IP configurations
assigned to the network interface.
The setting must be enabled for every network interface that is attached to the virtual machine that receives
traffic that the virtual machine needs to forward. A virtual machine can forward traffic whether it has multiple
network interfaces or a single network interface attached to it.
Box 1: Yes
The routing table allows connections from VM3 to VM1 and VM2. And as IP forwarding is enabled on VM3,
VM3 can connect to VM1.
Box 2: No
Box 3: Yes
The routing table allows connections from VM1 and VM2 to VM3. IP forwarding on VM3 allows VM1 to connect
to VM2 via VM3.
1E80AB545CC54BC463A489B460AC4397
Reference:
https://www.quora.com/What-is-IP-forwarding
QUESTION 12
A web app named webapp1

A virtual network named VNET1

Correct Answer: C
Section: (none)
Explanation
Explanation:
A Site-to-Site VPN gateway connection can be used to connect your on-premises network to an Azure virtual
network over an IPsec/IKE (IKEv1 or IKEv2) VPN tunnel.
This type of connection requires a VPN device, a VPN gateway, located on-premises that has an externally
facing public IP address assigned to it.
Incorrect Answers:
B: Application Proxy is a feature of Azure AD that enables users to access on-premises web applications from
a remote client.
Reference:
QUESTION 13
You plan to deploy several Azure virtual machines that will run Windows Server 2019 in a virtual machine scale
set by using an Azure Resource Manager template.

Correct Answer: C
Section: (none)
Explanation
1E80AB545CC54BC463A489B460AC4397
QUESTION 14
HOTSPOT
Ensure that communication between the web servers and the business logic tier spreads equally across the
virtual machines.
Protect the web servers from SQL injection attacks.
Which Azure resource should you recommend for each requirement? To answer, select the appropriate
Hot Area:
Correct Answer:
1E80AB545CC54BC463A489B460AC4397
Section: (none)
Explanation
Explanation:

Azure Internal Load Balancer (ILB) provides network load balancing between virtual machines that reside
inside a cloud service or a virtual network with a regional scope.

Azure Web Application Firewall (WAF) on Azure Application Gateway provides centralized protection of your
web applications from common exploits and vulnerabilities. Web applications are increasingly targeted by
malicious attacks that exploit commonly known vulnerabilities.
Reference:
QUESTION 15
Your company has three offices. The offices are located in Miami, Los Angeles, and New York. Each office
contains datacenter.
You have an Azure subscription that contains resources in the East US and West US Azure regions. Each
region contains a virtual network. The virtual networks are peered.
You need to connect the datacenters to the subscription. The solution must minimize network latency between
the datacenters.

Correct Answer: C
Section: (none)
Explanation
1E80AB545CC54BC463A489B460AC4397
Reference:
QUESTION 16
HOTSPOT
What is the minimum number of network interfaces and network security groups that you require? To answer,
Hot Area:
Correct Answer:
1E80AB545CC54BC463A489B460AC4397
Section: (none)
Explanation
Explanation:
Box 1: 5
Box 2: 1
You can associate zero, or one, network security group to each virtual network subnet and network interface in
a virtual machine. The same network security group can be associated to as many subnets and network
interfaces as you choose.
Reference:
QUESTION 17
HOTSPOT
You have Azure virtual machines that run Windows Server 2019 and are configured as shown in the following
table.
You create a private Azure DNS zone named adatum.com. You configure the adatum.com zone to allow auto
registration from VNET1.
Which A records will be added to the adatum.com zone for each virtual machine? To answer, select the
1E80AB545CC54BC463A489B460AC4397
Hot Area:
Correct Answer:
Section: (none)
Explanation
Explanation:
The virtual machines are registered (added) to the private zone as A records pointing to their private IP
addresses.
Reference:
1E80AB545CC54BC463A489B460AC4397
QUESTION 18
HOTSPOT
You have an Azure virtual network named VNet1 that connects to your on-premises network by using a site-to-
site VPN. VNet1 contains one subnet named Sunet1.
Subnet1 is associated to a network security group (NSG) named NSG1. Subnet1 contains a basic internal load
balancer named ILB1. ILB1 has three Azure virtual machines in the backend pool.
You need to collect data about the IP addresses that connects to ILB1. You must be able to run interactive
queries from the Azure portal against the collected data.
Hot Area:
Correct Answer:
Section: (none)
Explanation
1E80AB545CC54BC463A489B460AC4397
Explanation:

In the Azure portal you can set up a Log Analytics workspace, which is a unique Log Analytics environment
with its own data repository, data sources, and solutions
Box 2: ILB1
Reference:
QUESTION 19

B. VNet2 only
Correct Answer: D
Section: (none)
Explanation
Reference:
QUESTION 20
You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains four subnets
named Gateway, Perimeter, NVA, and Production.
The NVA subnet contains two network virtual appliances (NVAs) that will perform network traffic inspection
between the Perimeter subnet and the Production subnet.
You need to implement an Azure load balancer for the NVAs. The solution must meet the following
requirements:
The NVAs must run in an active-active configuration that uses automatic failover.
The NVA must load balance traffic to two services on the Production subnet. The services have different IP
addresses.
1E80AB545CC54BC463A489B460AC4397
Correct Answer: BCF

Section: (none)
Explanation
Explanation:
Incorrect Answers:
Reference:
QUESTION 21
You have an Azure subscription named Subscription1 that contains two Azure virtual networks named VNet1
and VNet2. VNet1 contains a VPN gateway named VPNGW1 that uses static routing. There is a site-to-site
VPN connection between your on-premises network and VNet1.
You configure virtual network peering between VNet1 and VNet2. You verify that you can connect to VNet2
from the on-premises network. Client1 is unable to connect to VNet2.
What should you do?

Correct Answer: A
Section: (none)
Explanation
Reference:
QUESTION 22
HOTSPOT
You have an Azure subscription. The subscription contains virtual machines that run Windows Server 2016
and are configured as shown in the following table.
1E80AB545CC54BC463A489B460AC4397
Hot Area:
1E80AB545CC54BC463A489B460AC4397
Correct Answer:
Section: (none)
Explanation
Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-
instances
QUESTION 23

1E80AB545CC54BC463A489B460AC4397
Correct Answer: D
Section: (none)
Explanation
Explanation:
All Azure resources are created in an Azure region and subscription. A resource can only be created in a virtual
network that exists in the same region and subscription as the resource.
Reference:
QUESTION 24
DRAG DROP
You have an Azure subscription that contains two virtual networks named VNet1 and VNet2. Virtual machines
connect to the virtual networks.
You need to add the address space of 10.33.0.0/16 to VNet1. The solution must ensure that the hosts on
VNet1 and VNet2 can communicate.
Select and Place:
1E80AB545CC54BC463A489B460AC4397
Correct Answer:
Section: (none)
Explanation
Explanation:

You can't add address ranges to, or delete address ranges from a virtual network's address space once a
virtual network is peered with another virtual network. To add or remove address ranges, delete the peering,
add or remove the address ranges, then re-create the peering.
Reference:
QUESTION 25
HOTSPOT
1E80AB545CC54BC463A489B460AC4397
RG2 contains a public IP address named IP2 that is in the East US location. IP2 is not assigned to a virtual
machine.
Hot Area:
Correct Answer:
Section: (none)
Explanation
Explanation:
Box 1: Yes
1E80AB545CC54BC463A489B460AC4397
Box 2: No
Box 3: No
Reference:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/move-support-resources
QUESTION 26
You have a virtual network named VNET1 and an Azure virtual machine named VM1 that hosts a MySQL
database. VM1 connects to VNET1.
What should you do?

Correct Answer: D
Section: (none)
Explanation
QUESTION 27
You have a computer named Computer1 that has a point-to-site VPN connection to an Azure virtual network
named VNet1. The point-to-site connection uses a self-signed certificate.
A. Yes
B. No
Correct Answer: B
1E80AB545CC54BC463A489B460AC4397
Section: (none)
Explanation
Explanation:
Note:
Each client computer that connects to a VNet using Point-to-Site must have a client certificate installed. You
generate a client certificate from the self-signed root certificate, and then export and install the client certificate.
If the client certificate is not installed, authentication fails.
Reference:
QUESTION 28
You have a computer named Computer1 that has a point-to-site VPN connection to an Azure virtual network
named VNet1. The point-to-site connection uses a self-signed certificate.
A. Yes
B. No
Correct Answer: B
Section: (none)
Explanation
Explanation:
Reference:
QUESTION 29
resource groups.
1E80AB545CC54BC463A489B460AC4397
networks.
A. Yes
B. No
Correct Answer: B
Section: (none)
Explanation
QUESTION 30
You have a computer named Computer1 that runs Windows 10. Computer1 is connected to the Internet.
From Computer1, you attempt to connect to VM1 by using Remote Desktop, but the connection fails.

1E80AB545CC54BC463A489B460AC4397
D. Start VM1
Correct Answer: D
Section: (none)
Explanation
Explanation:
Incorrect Answers:
A: Rules are processed in priority order, with lower numbers processed before higher numbers, because lower
numbers have higher priority. Once traffic matches a rule, processing stops. RDP already has the lowest
number and thus the highest priority.
Reference:
QUESTION 31
You need to ensure that all the virtual machines can resolve DNS names by using the DNS service on VM1.
What should you do?
1E80AB545CC54BC463A489B460AC4397
B. Add service endpoints on VNET1
Correct Answer: D
Section: (none)
Explanation
Explanation:
Virtual network peering enables you to seamlessly connect networks in Azure Virtual Network. The virtual
networks appear as one for connectivity purposes. The traffic between virtual machines uses the Microsoft
backbone infrastructure.
Incorrect Answers:
B, C: Virtual Network (VNet) service endpoint provides secure and direct connectivity to Azure services over an
optimized route over the Azure backbone network. Endpoints allow you to secure your critical Azure service
resources to only your virtual networks. Service Endpoints enables private IP addresses in the VNet to reach
the endpoint of an Azure service without needing a public IP address on the VNet.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview
QUESTION 32
HOTSPOT
You add inbound security rules to a network security group (NSG) named NSG1 as shown in the following
table.
1E80AB545CC54BC463A489B460AC4397
1E80AB545CC54BC463A489B460AC4397
Hot Area:
1E80AB545CC54BC463A489B460AC4397
Correct Answer:
Section: (none)
Explanation
Explanation:
Box 1: No
Box 2: Yes
Box 3: No
Reference:
QUESTION 33
You have the Azure virtual network named VNet1 that contains a subnet named Subnet1. Subnet1 contains
three Azure virtual machines. Each virtual machine has a public IP address.
The virtual machines host several applications that are accessible over port 443 to users on the Internet.
You discover that the virtual machines can be accessed by using the Remote Desktop Protocol (RDP) from the
Internet and from the on-premises network.
1E80AB545CC54BC463A489B460AC4397
You need to prevent RDP access to the virtual machines from the Internet, unless the RDP connection is
established from the on-premises network. The solution must ensure that all the applications can still be
accessed by the Internet users.
What should you do?

Correct Answer: B
Section: (none)
Explanation
Explanation:
You can use a site-to-site VPN to connect your on-premises network to an Azure virtual network. Users on your
on-premises network connect by using the RDP or SSH protocol over the site-to-site VPN connection. You
don't have to allow direct RDP or SSH access over the internet.
Reference:
QUESTION 34
What should you do?

Correct Answer: A
Section: (none)
Explanation
Explanation:
1E80AB545CC54BC463A489B460AC4397
References:
https://docs.microsoft.com/en-us/azure/virtual-network/security-overview#application-security-groups
QUESTION 35
You have an Azure subscription named Subscription1 that contains an Azure virtual network named VNet1.
VNet1 connects to your on-premises network by using Azure ExpressRoute.
You need to connect VNet1 to the on-premises network by using a site-to-site VPN. The solution must
minimize cost.
Correct Answer: ADE

Section: (none)
Explanation
Reference:
QUESTION 36
HOTSPOT
Hot Area:
1E80AB545CC54BC463A489B460AC4397
Correct Answer:
Section: (none)
Explanation
Explanation:
Box 1: vNET6 only

Box 2: delete peering1

Peering to Vnet1 is Enabled but disconnected. We need to update or re-create the remote peering to get it
back to Initiated state.
Reference:
1E80AB545CC54BC463A489B460AC4397
Testlet 2
Case study
study.

Overview
New York.
200 employees.
frequently.
as a VPN device.
table.
1E80AB545CC54BC463A489B460AC4397
GB of memory.
Requirements
Planned Changes

Montreal office.
office.
QUESTION 1
HOTSPOT
Hot Area:
1E80AB545CC54BC463A489B460AC4397
Correct Answer:
Section: (none)
Explanation
Explanation:

Azure VPN gateway. The VPN gateway service enables you to connect the VNet to the on-premises network
through a VPN appliance. For more information, see Connect an on-premises network to a Microsoft Azure
Virtual network gateway. A resource that provides a virtual VPN appliance for the VNet. It is responsible for
routing traffic from the on-premises network to the VNet.
Local network gateway. An abstraction of the on-premises VPN appliance. Network traffic from the cloud
1E80AB545CC54BC463A489B460AC4397
application to the on-premises network is routed through this gateway.
Connection. The connection has properties that specify the connection type (IPSec) and the key shared
with the on-premises VPN appliance to encrypt traffic.
Gateway subnet. The virtual network gateway is held in its own subnet, which is subject to various
requirements, described in the Recommendations section below.

On premises create a site-to-site connection for the virtual network gateway and the local network gateway.
Incorrect Answers:
Azure ExpressRoute: Established between your network and Azure, through an ExpressRoute partner. This
connection is private. Traffic does not go over the internet.
Reference:
https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/vpn
1E80AB545CC54BC463A489B460AC4397
Testlet 3
Case study
study.

Overview
File servers
Domain controllers
A SQL database
A web front end
Requirements
Planned Changes
1E80AB545CC54BC463A489B460AC4397

User Requirements
QUESTION 1
HOTSPOT
What should you include in the recommendation? To answer, select the appropriate options in the answer
area.
Hot Area:
1E80AB545CC54BC463A489B460AC4397
Correct Answer:
Section: (none)
Explanation
Explanation:
This reference architecture shows how to deploy VMs and a virtual network configured for an N-tier application,
using SQL Server on Windows for the data tier.
1E80AB545CC54BC463A489B460AC4397
A SQL database
A web front end

Reference:
1E80AB545CC54BC463A489B460AC4397
Monitor and back up Azure resources
Question Set 1
QUESTION 1
You need to provide the developers of webapp1 with real-time access to the connection errors. The solution
must provide all the connection error details.

Correct Answer: A
Section: (none)
Explanation
QUESTION 2
You have an Azure subscription that has a Recovery Services vault named Vault1. The subscription contains
the virtual machines shown in the following table:
A. VM1 and VM3 only

C. VM1 and VM2 only
D. VM1 only
Correct Answer: B
Section: (none)
Explanation
Explanation:
1E80AB545CC54BC463A489B460AC4397
Reference:
QUESTION 3
HOTSPOT
1E80AB545CC54BC463A489B460AC4397
Hot Area:
Correct Answer:
Section: (none)
Explanation
Explanation:
Box 1: 10 years
1E80AB545CC54BC463A489B460AC4397
Box 2: 36 months
QUESTION 4

Correct Answer: A
Section: (none)
Explanation
Explanation:
A Recovery Services vault is a storage entity in Azure that houses data. The data is typically copies of data, or
configuration information for virtual machines (VMs), workloads, servers, or workstations. You can use
Recovery Services vaults to hold backup data for various Azure services
Reference:
QUESTION 5
HOTSPOT
You have an Azure subscription that contains an Azure Storage account named storage1 and the users shown
in the following table.
1E80AB545CC54BC463A489B460AC4397
How many alert rules and action groups should you identify? To answer, select the appropriate options in the
answer area.
Hot Area:
Correct Answer:
1E80AB545CC54BC463A489B460AC4397
Section: (none)
Explanation
QUESTION 6
HOTSPOT
1E80AB545CC54BC463A489B460AC4397
How many recovery points are available on January 8 and January 15? To answer, select the appropriate
Hot Area:
1E80AB545CC54BC463A489B460AC4397
Correct Answer:
Section: (none)
Explanation
Explanation:
Box 1: 6
5 latest daily recovery points, which includes the weekly backup from the previous Sunday, plus the monthly
recovery point.
1E80AB545CC54BC463A489B460AC4397
Box 2: 8
Reference:
https://social.technet.microsoft.com/Forums/en-US/854ab6ae-79aa-4bad-ac65-471c4d422e94/daily-monthly-
yearly-recovery-points-and-storage-used?forum=windowsazureonlinebackup
QUESTION 7
HOTSPOT
You have an Azure Active Directory (Azure AD) tenant named contoso.onmicrosoft.com that contains the users
You enable password reset for contoso.onmicrosoft.com as shown in the Password Reset exhibit. (Click the
Password Reset tab.)
You configure the authentication methods for password reset as shown in the Authentication Methods exhibit.
(Click the Authentication Methods tab.)
1E80AB545CC54BC463A489B460AC4397
Hot Area:
1E80AB545CC54BC463A489B460AC4397
Correct Answer:
Section: (none)
Explanation
Explanation:
Box 1: No
Box 2: No
Box 3: Yes
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/authentication/active-directory-passwords-faq
QUESTION 8
The company’s security policy states that all personal devices and corporate-owned devices must be
1E80AB545CC54BC463A489B460AC4397
registered or joined to Azure AD.
What should you do?

Correct Answer: B
Section: (none)
Explanation
Explanation:
The Maximum number of devices setting enables you to select the maximum number of devices that a user
can have in Azure AD. If a user reaches this quota, they will not be able to add additional devices until one or
more of the existing devices are removed.
Incorrect Answers:
C: Azure AD Join enables users to join their devices to Active Directory from anywhere as long as they have
connectivity with the Internet.
D: The Users may join devices to Azure AD setting enables you to select the users who can join devices to
Azure AD. Options are All, Selected and None. The default is All.
Reference:
QUESTION 9
1E80AB545CC54BC463A489B460AC4397
A. Yes
B. No
Correct Answer: A
Section: (none)
Explanation
Explanation:
Reference:
1E80AB545CC54BC463A489B460AC4397
Testlet 2
Case study
study.

Overview
New York.
200 employees.
frequently.
as a VPN device.
table.
1E80AB545CC54BC463A489B460AC4397
GB of memory.
Requirements
Planned Changes

Montreal office.
office.
QUESTION 1
HOTSPOT
Which command should you run before you create Role1? To answer, select the appropriate options in the
answer area.
1E80AB545CC54BC463A489B460AC4397
Hot Area:
Correct Answer:
Section: (none)
Explanation
QUESTION 2
You need to recommend a solution to automate the configuration for the finance department users. The
solution must meet the technical requirements.
A. Azure AD B2C
Correct Answer: B
Section: (none)
Explanation
Explanation:
Scenario: Ensure Azure Multi-Factor Authentication (MFA) for the users in the finance department only.
The recommendation is to use conditional access policies that can then be targeted to groups of users, specific
applications, or other conditions.
Reference:
1E80AB545CC54BC463A489B460AC4397
AZ-104.examcollection.premium.exam.103q
Number: AZ-104
Passing Score: 800
Time Limit: 120 min
File Version: 2.0
AZ-104
Microsoft Azure Administrator (beta)
Version 2.0
This file was created using VCE Simulator from Avanset.com
AFA3EE56E4BA0FA32F0E5A587DBC0E34
Question Set 1
QUESTION 1
A. Yes
B. No
Correct Answer: A
Section: (none)
Explanation
Explanation:
Reference:
QUESTION 2
A. Yes
B. No
Correct Answer: B
Section: (none)
Explanation
Explanation:
Reference:
QUESTION 3
A. Yes
B. No
Correct Answer: B
Section: (none)
Explanation
Explanation:
Reference:
QUESTION 4
HOTSPOT
You need to ensure that an administrator named Admin1 can manage LB1 and LB2. The solution must follow
the principle of least privilege.
Which role should you assign to Admin1 for each task? To answer, select the appropriate options in the
answer area.
Hot Area:
Correct Answer:
Section: (none)
Explanation
Explanation:
Reference:
QUESTION 5
You have an Azure subscription that contains an Azure Active Directory (Azure AD) tenant named contoso.com
and an Azure Kubernetes Service (AKS) cluster named AKS1.

C. Recreate AKS1.
Correct Answer: B
Section: (none)
Explanation
Reference:
QUESTION 6
You plan to grant three users named User1, User2, and User3 access to a temporary Microsoft SharePoint
document library named Library1.
You need to create groups for the users. The solution must ensure that the groups are deleted automatically
after 180 days.

Correct Answer: AC
Section: (none)
Explanation
Explanation:
Note: With the increase in usage of Office 365 Groups, administrators and users need a way to clean up
unused groups. Expiration policies can help remove inactive groups from the system and make things cleaner.
When a group expires, all of its associated services (the mailbox, Planner, SharePoint site, etc.) are also
deleted.
Incorrect Answers:
Reference:
https://docs.microsoft.com/en-us/office365/admin/create-groups/office-365-groups-expiration-policy?
view=o365-worldwide
QUESTION 7
HOTSPOT
You have an Azure Active Directory (Azure AD) tenant named contoso.com that contains the users shown in
Hot Area:
Correct Answer:
Section: (none)
Explanation
Reference:
QUESTION 8
HOTSPOT
Hot Area:
Correct Answer:
Section: (none)
Explanation
Explanation:
Box 1: No
Box 2: Yes
permissions.
Box 3: Yes
permissions.
Reference:
https://docs.microsoft.com/en-us/azure/governance/management-groups/manage#moving-management-
groups-and-subscriptions
QUESTION 9
Correct Answer: B
Section: (none)
Explanation
Explanation:
ContosoRG1
QUESTION 10
HOTSPOT
Hot Area:
Correct Answer:
Section: (none)
Explanation
Explanation:

Note: Azure Policy allows you to use either built-in or custom-defined policy definitions and assign them to
either a specific resource group or across a whole Azure subscription.
Incorrect Answers:
RGROUP: RG6
Reference:
QUESTION 11

D. RVAULT1 only
Correct Answer: C
Section: (none)
Explanation
Explanation:
You can now move an Azure Recovery Service (ASR) Vault to either a new resource group within the current
subscription or to a new subscription.
Reference:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/move-resource-group-and-
subscription
QUESTION 12
Admin1 attempts to deploy an Azure Marketplace resource by using an Azure Resource Manager template.
Admin1 deploys the template by using Azure PowerShell and receives the following error message: “User
failed validation to purchase resources. Error message: “Legal terms have not been accepted for this item on
this subscription. To accept legal terms, please go to the Azure portal (http://go.microsoft.com/fwlink/?
LinkId=534873) and configure programmatic deployment for the Marketplace item or create it there for the first
time.”
What should you do?

Correct Answer: C
Section: (none)
Explanation
Reference:
https://docs.microsoft.com/en-us/powershell/module/az.marketplaceordering/set-azmarketplaceterms?
view=azps-4.1.0
QUESTION 13

Correct Answer: B
Section: (none)
Explanation
Explanation:
3. For the selected user, select Directory role, select Add role, and then pick the appropriate admin roles from
the Directory roles list, such as Conditional access administrator.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-users-assign-role-azure-
portal
QUESTION 14
You have an Azure Active Directory (Azure AD) tenant named contoso.onmicrosoft.com that contains 100 user
accounts.
What should you do?
Correct Answer: A
Section: (none)
Explanation
Reference:
QUESTION 15
You have an Azure subscription named Subscription1 and an on-premises deployment of Microsoft System
Center Service Manager.
You need to ensure that an alert is set in Service Manager when the amount of available memory on VM1 is
below 10 percent.

Correct Answer: C
Section: (none)
Explanation
Explanation:
The IT Service Management Connector (ITSMC) allows you to connect Azure and a supported IT Service
Management (ITSM) product/service, such as the Microsoft System Center Service Manager.
With ITSMC, you can create work items in ITSM tool, based on your Azure alerts (metric alerts, Activity Log
alerts and Log Analytics alerts).
Reference:
QUESTION 16
You need to add a user named admin1@contoso.com as an administrator on all the computers that will be
joined to the Azure AD domain.

Correct Answer: A
Section: (none)
Explanation
Explanation:
When you connect a Windows device with Azure AD using an Azure AD join, Azure AD adds the following
security principles to the local administrators group on the device:
In the Azure portal, you can manage the device administrator role on the Devices page. To open the Devices
page:
5. To modify the device administrator role, configure Additional local administrators on Azure AD joined
devices.
Reference:
QUESTION 17
HOTSPOT
Hot Area:
Correct Answer:
Section: (none)
Explanation
Explanation:
Box 1: Yes
Box 2: No
Note: Azure AD registered devices utilize an account managed by the end user, this account is either a
Microsoft account or another locally managed credential.
Box 3: Yes
Reference:
QUESTION 18
RG26 is set to the West Europe location and is used to create temporary resources for a project. RG26
contains the resources shown in the following table.
A. Delete VM1
B. Stop VM1
D. Delete sa001
Correct Answer: C
Section: (none)
Explanation
QUESTION 19
You have an Azure subscription named Subscription1 that contains a virtual network named VNet1. VNet1 is in
a resource group named RG1.
Reader
Security Admin
Security Reader
What should you do?
A. Remove User 1 from the Security Reader role for Subscription1. Assign User1 the Contributor role for RG1.
Correct Answer: B
Section: (none)
Explanation
Explanation:
Reference:
QUESTION 20
A. MX
B. NSEC
C. SRV
D. NSEC3
Correct Answer: A
Section: (none)
Explanation
Reference:
Question Set 1
QUESTION 1
DRAG DROP
Select and Place:
Correct Answer:
Section: (none)
Explanation
Explanation:

Azure file share


Reference:
QUESTION 2
HOTSPOT
Replicates synchronously.
Remains available if a single data center in the region fails.
Hot Area:
Correct Answer:
Section: (none)
Explanation
Explanation:

Zone-redundant storage (ZRS) replicates your data synchronously across three storage clusters in a single
region.

Reference:
QUESTION 3

D. file only
Correct Answer: B
Section: (none)
Explanation
Explanation:
Incorrect Answers:
Reference:
QUESTION 4
HOTSPOT
Which authentication method should you use for each type of storage? To answer, select the appropriate
Hot Area:
Correct Answer:
Section: (none)
Explanation
Explanation:
You can provide authorization credentials by using Azure Active Directory (AD), or by using a Shared Access
Signature (SAS) token.
Box 1:
Box 2:
Reference:
QUESTION 5
You plan to create an Azure container instance named container1 that will use a Docker image named Image1.
Image1 contains a Microsoft SQL Server instance that requires persistent storage.
A. Azure Files
Correct Answer: D
Section: (none)
Explanation
QUESTION 6
You plan to implement an Azure Availability Set for App1. The solution must ensure that App1 is available
during planned maintenance of the hardware hosting VM1 and VM2.

C. one fault domain
Correct Answer: D
Section: (none)
Explanation
Explanation:
Microsoft updates, which Microsoft refers to as planned maintenance events, sometimes require that VMs be
rebooted to complete the update. To reduce the impact on VMs, the Azure fabric is divided into update
domains to ensure that not all VMs are rebooted at the same time.
Incorrect Answers:
A: An update domain is a group of VMs and underlying physical hardware that can be rebooted at the same
time.
B, C: A fault domain shares common storage as well as a common power source and network switch. It is
used to protect against unplanned system failure.
References:
QUESTION 7
HOTSPOT
Which storage accounts and which Log Analytics workspaces can you use for the Azure Backup reports of
Vault1? To answer, select the appropriate options in the answer area.
Hot Area:
Correct Answer:
Section: (none)
Explanation
Explanation:

Box 2: Analytics3
Reference:
QUESTION 8
HOTSPOT
Hot Area:
Correct Answer:
Section: (none)
Explanation
Explanation:


Reference:
https://docs.microsoft.com/en-us/azure/storage/common/storage-dotnet-shared-access-signature-part-1
https://docs.microsoft.com/en-us/azure/vs-azure-tools-storage-manage-with-storage-explorer?tabs=windows
QUESTION 9
You need to copy the contents of D:\Folder1 to the public container in an Azure Storage account named
contosodata.
B. azcopy sync D:\folder1 https://contosodata.blob.core.windows.net/public --
snapshot
C. azcopy copy D:\folder1 https://contosodata.blob.core.windows.net/public --
recursive
D. az storage blob copy start-batch D:\Folder1 https://
contosodata.blob.core.windows.net/public
Correct Answer: C
Section: (none)
Explanation
Explanation:
The azcopy copy command copies a directory (and all of the files in that directory) to a blob container. The
result is a directory in the container by the same name.
Incorrect Answers:
B: The azcopy sync command replicates the source location to the destination location. However, the file is
skipped if the last modified time in the destination is more recent.
Reference:
QUESTION 10
You have an Azure subscription named Subscription1 that contains the storage accounts shown in the
following table:
A. storage1
B. storage2
C. storage3
D. storage4
Correct Answer: D
Section: (none)
Explanation
Explanation:

Reference:
QUESTION 11
HOTSPOT
You create a Storage Sync Service named Sync1 and an Azure File Sync group named Group1. Group1 uses
share1 as a cloud endpoint.
Hot Area:
Correct Answer:
Section: (none)
Explanation
Explanation:
Box 1: No
A sync group must contain one cloud endpoint, which represents an Azure file share and one or more server
endpoints.
Box 2: Yes
Box 3: Yes
Reference:
QUESTION 12
DRAG DROP
Which UNC path should you include in a script that references files from the data file share? To answer, drag
the appropriate values to the correct targets. Each value may be used once, more than once or not at all. You
Select and Place:
Correct Answer:
Section: (none)
Explanation
Explanation:
The name of account
Box 3: data
Example:
Reference:
QUESTION 13
HOTSPOT
Hot Area:
Correct Answer:
Section: (none)
Explanation
QUESTION 14
HOTSPOT
On which endpoints will File1 and File2 be available within 24 hours of adding the files? To answer, select the
Hot Area:
Correct Answer:
Section: (none)
Explanation
Explanation:

Cloud Tiering: A switch to enable or disable cloud tiering. When enabled, cloud tiering will tier files to your
Azure file shares. This converts on-premises file shares into a cache, rather than a complete copy of the
dataset, to help you manage space efficiency on your server. With cloud tiering, infrequently used or accessed
files can be tiered to Azure Files.
Reference:
QUESTION 15
HOTSPOT
Hot Area:
Correct Answer:
Section: (none)
Explanation
Explanation:
Box 1: always
Box 2: Never
After you configure firewall and virtual network settings for your storage account, select Allow trusted Microsoft
services to access this storage account as an exception to enable Azure Backup service to access the network
restricted storage account.
Reference:
https://azure.microsoft.com/en-us/blog/azure-backup-now-supports-storage-accounts-secured-with-azure-
storage-firewalls-and-virtual-networks/
QUESTION 16
HOTSPOT
You have a sync group named Sync1 that has a cloud endpoint. The cloud endpoint includes a file named
File1.txt.
Your on-premises network contains servers that run Windows Server 2016. The servers are configured as
Hot Area:
Correct Answer:
Section: (none)
Explanation
Explanation:
Box 1: Yes
If you add an Azure file share that has an existing set of files as a cloud endpoint to a sync group, the existing
files are merged with any other files that are already on other endpoints in the sync group.
Box 2: No
Box 3: Yes
Reference:
QUESTION 17
You need to identify which storage account can be converted to zone-redundant storage (ZRS) replication by
requesting a live migration from Azure support.
A. storage1
B. storage2
C. storage3
D. storage4
Correct Answer: B
Section: (none)
Explanation
Explanation:
ZRS currently supports standard general-purpose v2, FileStorage and BlockBlobStorage storage account
types.
Incorrect Answers:
A, not C: Live migration is supported only for storage accounts that use LRS replication. If your account uses
GRS or RA-GRS, then you need to first change your account's replication type to LRS before proceeding. This
intermediary step removes the secondary endpoint provided by GRS/RA-GRS.
Also, only standard storage account types support live migration. Premium storage accounts must be migrated
manually.
D: ZRS currently supports standard general-purpose v2, FileStorage and BlockBlobStorage storage account
types.
Reference:
QUESTION 18
You plan to upload the disk files of a virtual machine to account1 from your on-premises network. The on-
premises network uses a public IP address space of 131.107.1.0/24.
You plan to use the disk files to provision an Azure virtual machine named VM1. VM1 will be attached to a
virtual network named VNet1. VNet1 uses an IP address space of 192.168.0.0/24.
Ensure that you can upload the disk files to account1.

Ensure that you can attach the disks to VM1.
Prevent all other access to account1.
B. From the Firewalls and virtual networks blade of account1, select Allow trusted Microsoft services to
Correct Answer: AE
Section: (none)
Explanation
Explanation:
A: By default, storage accounts accept connections from clients on any network. To limit access to selected
networks, you must first change the default action.
Azure portal
3. To deny access by default, choose to allow access from 'Selected networks'. To allow traffic from all
networks, choose to allow access from 'All networks'.

By enabling a Service Endpoint for Azure Storage within the Virtual Network, traffic is ensured an optimal route
to the Azure Storage service. The identities of the virtual network and the subnet are also transmitted with each
request.
Reference:
Testlet 2
Case study
study.

Overview
File servers
Domain controllers
A SQL database
A web front end
Requirements
Planned Changes

User Requirements
QUESTION 1
A. a recovery plan
C. a backup policy
Correct Answer: D
Section: (none)
Explanation
Explanation:
A Recovery Services vault is a logical container that stores the backup data for each protected resource, such
as Azure VMs. When the backup job for a protected resource runs, it creates a recovery point inside the
Recovery Services vault.
Scenario:
Reference:
QUESTION 2
What should you do?
Correct Answer: B
Section: (none)
Explanation
Explanation:
Azure Storage Explorer is a free tool from Microsoft that allows you to work with Azure Storage data on
Windows, macOS, and Linux. You can use it to upload and download data from Azure blob storage.
Scenario:
Reference:
https://docs.microsoft.com/en-us/azure/machine-learning/team-data-science-process/move-data-to-azure-blob-
using-azure-storage-explorer
QUESTION 3
HOTSPOT
Hot Area:
Correct Answer:
Section: (none)
Explanation
Explanation:
Box 1: Yes
Box 2: No
Box 3: No
Question Set 1
QUESTION 1
deployment.
A. Yes
B. No
Correct Answer: B
Section: (none)
Explanation
Explanation:
Reference:
QUESTION 2
A. Yes
B. No
Correct Answer: B
Section: (none)
Explanation
Explanation:
Reference:
QUESTION 3
A. Yes
B. No
Correct Answer: A
Section: (none)
Explanation
Explanation:
Reference:
QUESTION 4
A. Azure HDInsight
Correct Answer: C
Section: (none)
Explanation
Explanation:
The basic host metrics are available, but to see more granular and VM-specific metrics, you need to install the
Azure diagnostics extension on the VM. The Azure diagnostics extension allows additional monitoring and
diagnostics data to be retrieved from the VM.
Reference:
QUESTION 5
HOTSPOT
Hot Area:
Correct Answer:
Section: (none)
Explanation
QUESTION 6
You plan to deploy three Azure virtual machines named VM1, VM2, and VM3. The virtual machines will host a
web app named App1.
You need to ensure that at least two virtual machines are available if a single Azure datacenter becomes
unavailable.

Correct Answer: B
Section: (none)
Explanation
Explanation:
Availability sets are a datacenter configuration to provide VM redundancy and availability. This configuration
within a datacenter ensures that during either a planned or unplanned maintenance event, at least one virtual
machine is available.
Reference:
QUESTION 7
A. operating system
D. resource group
Correct Answer: B
Section: (none)
Explanation
Explanation:
the Resource Group name and location for the VM
the administrator username and password
an unique DNS name for the public IP
Reference:
QUESTION 8
You have an Azure subscription that contains an Azure virtual machine named VM1. VM1 runs a financial
reporting app named App1 that does not support multiple active instances.
You need to create a scheduled runbook to increase the processor performance of VM1 at the end of each
month.

Correct Answer: E
Section: (none)
Explanation
Reference:
QUESTION 9
Create files on drive C.

Create files on drive D.
Modify the screen saver timeout.
Change the desktop background.

Correct Answer: A
Section: (none)
Explanation
QUESTION 10
You have an on-premises virtual machine named VM1. The settings for VM1 are shown in the exhibit. (Click
the Exhibit tab.)
A. the memory
C. the hard drive
D. the processor
Correct Answer: C
Section: (none)
Explanation
Explanation:
Before you upload a Windows virtual machine (VM) from on-premises to Microsoft Azure, you must prepare
the virtual hard disk (VHD or VHDX). Azure supports only generation 1 VMs that are in the VHD file format and
have a fixed sized disk. The maximum size allowed for the VHD is 1,023 GB. You can convert a generation 1
VM from the VHDX file system to VHD and from a dynamically expanding disk to fixed-sized.
Reference:
QUESTION 11
HOTSPOT
You have an Azure subscription that contains a virtual machine scale set. The scale set contains four instances
that have the following configurations:
Operating system: Windows Server 2016

Size: Standard_D1_v2
Hot Area:
Correct Answer:
Section: (none)
Explanation
Explanation:
The Get-AzVmssVM cmdlet gets the model view and instance view of a Virtual Machine Scale Set (VMSS)
virtual machine.
Box 1: 0
The enableAutomaticUpdates parameter is set to false. To update existing VMs, you must do a manual
upgrade of each existing VM.
Box 2: 4
Enabling automatic OS image upgrades on your scale set helps ease update management by safely and
automatically upgrading the OS disk for all instances in the scale set.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-upgrade-scale-
set
https://docs.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-automatic-
upgrade
QUESTION 12
You have an Azure subscription named Subscription1 that is used by several departments at your company.
Subscription1 contains the resources in the following table:
Another administrator deploys a virtual machine named VM1 and an Azure Storage account named storage2
by using a single Azure Resource Manager template.
A. VM1
B. RG1
C. storage2
D. container1
Correct Answer: B
Section: (none)
Explanation
Explanation:
1. Go to the resource group for your new resource group. Notice that the portal shows the result of the last
deployment. Select this link.
2. You see a history of deployments for the group. In your case, the portal probably lists only one deployment.
Select this deployment.
3. The portal displays a summary of the deployment. The summary includes the status of the deployment and
its operations and the values that you provided for parameters. To see the template that you used for the
deployment, select View template.
Reference:
QUESTION 13
You back up App1.
What should you do?
A. Redeploy App1
B. Swap the slots
C. Clone App1
Correct Answer: B
Section: (none)
Explanation
Explanation:
When you swap deployment slots, Azure swaps the Virtual IP addresses of the source and destination slots,
thereby swapping the URLs of the slots. We can easily revert the deployment by swapping back.
Reference:
QUESTION 14
HOTSPOT
You have an Azure subscription named Subscription1. Subscription1 contains two Azure virtual machines VM1
and VM2. VM1 and VM2 run Windows Server 2016.
Hot Area:
Correct Answer:
Section: (none)
Explanation
Explanation:
Reference:
QUESTION 15
VM1 within an hour.
Solution: You create an Azure Log Analytics workspace and configure the data settings. You add the Microsoft
Monitoring Agent VM extension to VM1. You create an alert in Azure Monitor and specify the Log Analytics
A. Yes
B. No
Correct Answer: B
Section: (none)
Explanation
Explanation:
Reference:
QUESTION 16
VM1 within an hour.
Solution: You create an Azure Log Analytics workspace and configure the data settings. You install the
A. Yes
B. No
Correct Answer: A
Section: (none)
Explanation
Explanation:
Alerts in Azure Monitor can identify important information in your Log Analytics repository. They are created by
alert rules that automatically run log searches at regular intervals, and if results of the log search match
particular criteria, then an alert record is created and it can be configured to perform an automated response.
The Log Analytics agent collects monitoring data from the guest operating system and workloads of virtual
machines in Azure, other cloud providers, and on-premises. It collects data into a Log Analytics workspace.
Reference:
QUESTION 17
VM1 within an hour.
Solution: You create an Azure storage account and configure shared access signatures (SASs). You install the
Microsoft Monitoring Agent on VM1. You create an alert in Azure Monitor and specify the storage account as
the source.
A. Yes
B. No
Correct Answer: B
Section: (none)
Explanation
Explanation:
Reference:
QUESTION 18
A. Yes
B. No
Correct Answer: B
Section: (none)
Explanation
Explanation:
VNet.
Reference:
QUESTION 19
Solution: You delete VM1. You recreate VM1, and then you create a new network interface for VM1 and
connect it to VNET2.
A. Yes
B. No
Correct Answer: A
Section: (none)
Explanation
Explanation:
VNet.
Reference:
QUESTION 20
A. Yes
B. No
Correct Answer: B
Section: (none)
Explanation
Explanation:
VNet.
Reference:
QUESTION 21
HOTSPOT
Hot Area:
Correct Answer:
Section: (none)
Explanation
Explanation:
The total regional vCPUs is 20 so that means a maximum total of 20 vCPUs across all the different VM sizes.
The deallocated VM with 16 vCPUs counts towards the total. VM20 and VM1 are using 18 of the maximum 20
vCPUs leaving only two vCPUs available.
Reference:
QUESTION 22
HOTSPOT
You have an Azure subscription that contains an Azure Availability Set named WEBPROD-AS-USE2 as shown
in the following exhibit.
Hot Area:
Correct Answer:
Section: (none)
Explanation
Explanation:
Box 1: 2
There are 10 update domains. The 14 VMs are shared across the 10 update domains so four update domains
will have two VMs and six update domains will have one VM. Only one update domain is rebooted at a time.
Therefore, a maximum of two VMs will be offline.
Box 2: 7
There are 2 fault domains. The 14 VMs are shared across the 2 fault domains, so 7 VMs in each fault domain.
A rack failure will affect one fault domain so 7 VMs will be offline.
Reference:
QUESTION 23
You deploy an Azure Kubernetes Service (AKS) cluster named Cluster1 that uses the IP addresses shown in
A. 131.107.2.1
B. 10.0.10.11
C. 172.17.7.1
D. 192.168.10.2
Correct Answer: A
Section: (none)
Explanation
QUESTION 24

Correct Answer: B
Section: (none)
Explanation
Explanation:
Reference:
QUESTION 25
HOTSPOT
Hot Area:
Correct Answer:
Section: (none)
Explanation
QUESTION 26
You have an Azure subscription that contains a virtual machine named VM1. VM1 hosts a line-of-business
application that is available 24 hours a day. VM1 has one network interface and one managed disk. VM1 uses
the D4s v3 size.

Enable Desired State Configuration Management.

Correct Answer: C
Section: (none)
Explanation
Explanation:
Reference:
QUESTION 27
A. Swap the slots

Correct Answer: AD
Section: (none)
Explanation
QUESTION 28
Authorization
Automation
Resources
Compute
KeyVault
Network
Storage
Billing
Web

Subnet: 10.0.0.0/24
Managed disks: No
Location: East US

Correct Answer: ACD

Section: (none)
Explanation
Explanation:
D: NSG flow log data is written to an Azure Storage account. You need to create an Azure Storage account,
Reference:
QUESTION 29
What should you do?
Correct Answer: D
Section: (none)
Explanation
Reference:
QUESTION 30
A. 1
B. 2
C. 3
D. 4
Correct Answer: A
Section: (none)
Explanation
QUESTION 31
HOTSPOT
Hot Area:
Correct Answer:
Section: (none)
Explanation
Explanation:


Budget alerts for Resource Group RG1, which include VM1, but not VM2.VM1 consumes 20 Euro/day. The
50%, 500 Euro limit, will be reached in 25 days, and an email will be sent.
The 70% and 100% alert conditions will not be reached within a month, and they don't trigger email actions
anyway.
Credit alerts: Credit alerts are generated automatically at 90% and at 100% of your Azure credit balance.
Whenever an alert is generated, it's reflected in cost alerts and in the email sent to the account owners. 90%
and 100% will not be reached though.
Reference:
Question Set 1
QUESTION 1
resource groups.
networks.
A. Yes
B. No
Correct Answer: B
Section: (none)
Explanation
Explanation:
Reference:
QUESTION 2
resource groups.
networks.
A. Yes
B. No
Correct Answer: B
Section: (none)
Explanation
Explanation:
Reference:
QUESTION 3
resource groups.
networks.
A. Yes
B. No
Correct Answer: A
Section: (none)
Explanation
Explanation:
Reference:
QUESTION 4
You have two Azure virtual networks named VNet1 and VNet2. VNet1 contains an Azure virtual machine
named VM1. VNet2 contains an Azure virtual machine named VM2.
A. IP flow verify
D. NSG flow logs
Correct Answer: C
Section: (none)
Explanation
Explanation:
The connection monitor capability monitors communication at a regular interval and informs you of reachability,
latency, and network topology changes between the VM and the endpoint
Incorrect Answers:
A: The IP flow verify capability enables you to specify a source and destination IPv4 address, port, protocol
(TCP or UDP), and traffic direction (inbound or outbound). IP flow verify then tests the communication and
informs you if the connection succeeds or fails. If the connection fails, IP flow verify tells you which security rule
allowed or denied the communication, so that you can resolve the problem.
B: The connection troubleshoot capability enables you to test a connection between a VM and another VM, an
FQDN, a URI, or an IPv4 address. The test returns similar information returned when using the connection
monitor capability, but tests the connection at a point in time, rather than monitoring it over time, as connection
monitor does.
D: The NSG flow log capability allows you to log the source and destination IP address, port, protocol, and
whether traffic was allowed or denied by an NSG.
Reference:
QUESTION 5
You have an Azure subscription that contains a policy-based virtual network gateway named GW1 and a virtual
network named VNet1.

B. Reset GW1
E. Delete GW1
Correct Answer: CE
Section: (none)
Explanation
Explanation:
Route-based VPN devices use any-to-any (wildcard) traffic selectors, and let routing/forwarding tables direct
traffic to different IPsec tunnels. It is typically built on router platforms where each IPsec tunnel is modeled as a
network interface or VTI (virtual tunnel interface).
E: Policy-based VPN devices use the combinations of prefixes from both networks to define how traffic is
encrypted/decrypted through IPsec tunnels. It is typically built on firewall devices that perform packet filtering.
IPsec tunnel encryption and decryption are added to the packet filtering and processing engine.
Incorrect Answers:
Reference:
https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-connect-multiple-policybased-rm-ps
QUESTION 6
HOTSPOT
In Azure, you create a private DNS zone named adatum.com. You set the registration virtual network to VNet2.
The adatum.com zone is configured as shown in the following exhibit:
Hot Area:
Correct Answer:
Section: (none)
Explanation
Explanation:
Box 1: No
Azure DNS provides automatic registration of virtual machines from a single virtual network that's linked to a
private zone as a registration virtual network. VM5 does not belong to the registration virtual network though.
Box 2: No
Forward DNS resolution is supported across virtual networks that are linked to the private zone as resolution
virtual networks. VM5 does belong to a resolution virtual network.
Box 3: Yes
By default, registration virtual networks also act as resolution virtual networks, in the sense that DNS resolution
against the zone works from any of the virtual machines within the registration virtual network.
Reference:
QUESTION 7
HOTSPOT
You have an Azure subscription that contains a virtual network named VNet1. VNet1 uses an IP address space
of 10.0.0.0/16 and contains the subnets in the following table:
Hot Area:
Correct Answer:
Section: (none)
Explanation
QUESTION 8
You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as
web servers.

C. Protocol to UDP
Correct Answer: D
Section: (none)
Explanation
Explanation:
With Sticky Sessions when a client starts a session on one of your web servers, session stays on that specific
server. To configure An Azure Load-Balancer For Sticky Sessions set Session persistence to Client IP.
Reference:
QUESTION 9
HOTSPOT
VM1 and VM2 use public IP addresses. From Windows Server 2019 on VM1 and VM2, you allow inbound
Remote Desktop connections.
The subscription contains two network security groups (NSGs) named NSG1 and NSG2. NSG1 uses only the
default rules.
Priority: 100
Name: Rule1
Port: 3389
Protocol: TCP
Source: Any
Destination: Any
Action: Allow
Hot Area:
Correct Answer:
Section: (none)
Explanation
QUESTION 10
HOTSPOT
You have two Azure virtual machines that have the network configurations shown in the following table:
Hot Area:
Correct Answer:
Section: (none)
Explanation
Explanation:
Box 1: Yes
The inbound security rule for NSG1 allows TCP port 1433 from 10.10.2.0/24 (or Subnet2 where VM2 and VM3
are located) to 10.10.1.0/24 (or Subnet1 where VM1 is located) while the inbound security rule for NSG2 blocks
TCP port 1433 from 10.10.2.5 (or VM2) to 10.10.1.5 (or VM1). However, the NSG1 rule has a higher priority (or
lower value) than the NSG2 rule.
Box 2: Yes
No rule explicitly blocks communication from VM1. The default rules, which allow communication, are thus
applied.
Box 3: Yes
No rule explicitly blocks communication between VM2 and VM3 which are both on Subnet2. The default rules,
which allow communication, are thus applied.
Reference:
QUESTION 11
HOTSPOT
VM3 has multiple network adapters, including a network adapter named NIC3. IP forwarding is enabled on
NIC3. Routing is enabled on VM3.
Hot Area:
Correct Answer:
Section: (none)
Explanation
Explanation:
Receive network traffic not destined for one of the IP addresses assigned to any of the IP configurations
assigned to the network interface.
The setting must be enabled for every network interface that is attached to the virtual machine that receives
traffic that the virtual machine needs to forward. A virtual machine can forward traffic whether it has multiple
network interfaces or a single network interface attached to it.
Box 1: Yes
The routing table allows connections from VM3 to VM1 and VM2. And as IP forwarding is enabled on VM3,
VM3 can connect to VM1.
Box 2: No
Box 3: Yes
The routing table allows connections from VM1 and VM2 to VM3. IP forwarding on VM3 allows VM1 to connect
to VM2 via VM3.
Reference:
QUESTION 12
A web app named webapp1

A virtual network named VNET1

Correct Answer: C
Section: (none)
Explanation
Explanation:
A Site-to-Site VPN gateway connection can be used to connect your on-premises network to an Azure virtual
network over an IPsec/IKE (IKEv1 or IKEv2) VPN tunnel.
This type of connection requires a VPN device, a VPN gateway, located on-premises that has an externally
facing public IP address assigned to it.
Incorrect Answers:
B: Application Proxy is a feature of Azure AD that enables users to access on-premises web applications from
a remote client.
Reference:
QUESTION 13
You plan to deploy several Azure virtual machines that will run Windows Server 2019 in a virtual machine scale
set by using an Azure Resource Manager template.

Correct Answer: C
Section: (none)
Explanation
QUESTION 14
HOTSPOT
Ensure that communication between the web servers and the business logic tier spreads equally across the
virtual machines.
Protect the web servers from SQL injection attacks.
Which Azure resource should you recommend for each requirement? To answer, select the appropriate
Hot Area:
Correct Answer:
Section: (none)
Explanation
Explanation:

Azure Internal Load Balancer (ILB) provides network load balancing between virtual machines that reside
inside a cloud service or a virtual network with a regional scope.

Azure Web Application Firewall (WAF) on Azure Application Gateway provides centralized protection of your
web applications from common exploits and vulnerabilities. Web applications are increasingly targeted by
malicious attacks that exploit commonly known vulnerabilities.
Reference:
QUESTION 15
Your company has three offices. The offices are located in Miami, Los Angeles, and New York. Each office
contains datacenter.
You have an Azure subscription that contains resources in the East US and West US Azure regions. Each
region contains a virtual network. The virtual networks are peered.
You need to connect the datacenters to the subscription. The solution must minimize network latency between
the datacenters.

Correct Answer: C
Section: (none)
Explanation
Reference:
QUESTION 16
HOTSPOT
What is the minimum number of network interfaces and network security groups that you require? To answer,
Hot Area:
Correct Answer:
Section: (none)
Explanation
Explanation:
Box 1: 5
Box 2: 1
You can associate zero, or one, network security group to each virtual network subnet and network interface in
a virtual machine. The same network security group can be associated to as many subnets and network
interfaces as you choose.
Reference:
QUESTION 17
HOTSPOT
You have Azure virtual machines that run Windows Server 2019 and are configured as shown in the following
table.
You create a private Azure DNS zone named adatum.com. You configure the adatum.com zone to allow auto
registration from VNET1.
Which A records will be added to the adatum.com zone for each virtual machine? To answer, select the
Hot Area:
Correct Answer:
Section: (none)
Explanation
Explanation:
The virtual machines are registered (added) to the private zone as A records pointing to their private IP
addresses.
Reference:
QUESTION 18
HOTSPOT
You have an Azure virtual network named VNet1 that connects to your on-premises network by using a site-to-
site VPN. VNet1 contains one subnet named Sunet1.
Subnet1 is associated to a network security group (NSG) named NSG1. Subnet1 contains a basic internal load
balancer named ILB1. ILB1 has three Azure virtual machines in the backend pool.
You need to collect data about the IP addresses that connects to ILB1. You must be able to run interactive
queries from the Azure portal against the collected data.
Hot Area:
Correct Answer:
Section: (none)
Explanation
Explanation:

In the Azure portal you can set up a Log Analytics workspace, which is a unique Log Analytics environment
with its own data repository, data sources, and solutions
Box 2: ILB1
Reference:
QUESTION 19

B. VNet2 only
Correct Answer: D
Section: (none)
Explanation
Reference:
QUESTION 20
You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains four subnets
named Gateway, Perimeter, NVA, and Production.
The NVA subnet contains two network virtual appliances (NVAs) that will perform network traffic inspection
between the Perimeter subnet and the Production subnet.
requirements:
The NVAs must run in an active-active configuration that uses automatic failover.
The NVA must load balance traffic to two services on the Production subnet. The services have different IP
addresses.
Correct Answer: BCF

Section: (none)
Explanation
Explanation:
Incorrect Answers:
Reference:
QUESTION 21
You have an Azure subscription named Subscription1 that contains two Azure virtual networks named VNet1
and VNet2. VNet1 contains a VPN gateway named VPNGW1 that uses static routing. There is a site-to-site
VPN connection between your on-premises network and VNet1.
You configure virtual network peering between VNet1 and VNet2. You verify that you can connect to VNet2
from the on-premises network. Client1 is unable to connect to VNet2.
What should you do?

Correct Answer: A
Section: (none)
Explanation
Reference:
QUESTION 22
HOTSPOT
You have an Azure subscription. The subscription contains virtual machines that run Windows Server 2016
and are configured as shown in the following table.
Hot Area:
Correct Answer:
Section: (none)
Explanation
Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-
instances
QUESTION 23

Correct Answer: D
Section: (none)
Explanation
Explanation:
All Azure resources are created in an Azure region and subscription. A resource can only be created in a virtual
network that exists in the same region and subscription as the resource.
Reference:
QUESTION 24
DRAG DROP
You have an Azure subscription that contains two virtual networks named VNet1 and VNet2. Virtual machines
connect to the virtual networks.
You need to add the address space of 10.33.0.0/16 to VNet1. The solution must ensure that the hosts on
VNet1 and VNet2 can communicate.
Select and Place:
Correct Answer:
Section: (none)
Explanation
Explanation:

You can't add address ranges to, or delete address ranges from a virtual network's address space once a
virtual network is peered with another virtual network. To add or remove address ranges, delete the peering,
add or remove the address ranges, then re-create the peering.
Reference:
QUESTION 25
HOTSPOT
RG2 contains a public IP address named IP2 that is in the East US location. IP2 is not assigned to a virtual
machine.
Hot Area:
Correct Answer:
Section: (none)
Explanation
Explanation:
Box 1: Yes
Box 2: No
Box 3: No
Reference:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/move-support-resources
Testlet 2
Case study
study.

Overview
File servers
Domain controllers
A SQL database
A web front end
Requirements
Planned Changes

User Requirements
QUESTION 1
HOTSPOT
What should you include in the recommendation? To answer, select the appropriate options in the answer
area.
Hot Area:
Correct Answer:
Section: (none)
Explanation
Explanation:
This reference architecture shows how to deploy VMs and a virtual network configured for an N-tier application,
using SQL Server on Windows for the data tier.
A SQL database
A web front end

Reference:
Question Set 1
QUESTION 1
You need to provide the developers of webapp1 with real-time access to the connection errors. The solution
must provide all the connection error details.

Correct Answer: A
Section: (none)
Explanation
QUESTION 2
You have an Azure subscription that has a Recovery Services vault named Vault1. The subscription contains
the virtual machines shown in the following table:
A. VM1 and VM3 only

C. VM1 and VM2 only
D. VM1 only
Correct Answer: B
Section: (none)
Explanation
Explanation:
Reference:
QUESTION 3
HOTSPOT
Hot Area:
Correct Answer:
Section: (none)
Explanation
Explanation:
Box 1: 10 years
Box 2: 36 months
QUESTION 4

Correct Answer: A
Section: (none)
Explanation
Explanation:
A Recovery Services vault is a storage entity in Azure that houses data. The data is typically copies of data, or
configuration information for virtual machines (VMs), workloads, servers, or workstations. You can use
Recovery Services vaults to hold backup data for various Azure services
Reference:
QUESTION 5
HOTSPOT
You have an Azure subscription that contains an Azure Storage account named storage1 and the users shown
in the following table.
How many alert rules and action groups should you identify? To answer, select the appropriate options in the
answer area.
Hot Area:
Correct Answer:
Section: (none)
Explanation
CloudCertified Practice Tests
AZ-104 : Microsoft Azure Administrator
Question #1
the series contains a unique solution that might meet the stated goals. Some question sets might
have more than one correct solution, while others might not have a correct solution.
You have an Azure subscription that contains the following users in an Azure Active Directory tenant
named contoso.onmicrosoft.com:

 A. Yes
 B. No
Answer: B
Reference:
Question #2

 A. Yes
 B. No
Answer: B
Reference:
Question #3

 A. Yes
 B. No
Answer: B
Reference:
Question #4
HOTSPOT -
You need to ensure that an administrator named Admin1 can manage LB1 and LB2. The solution
must follow the principle of least privilege.
Which role should you assign to Admin1 for each task? To answer, select the appropriate options in
the answer area.
Hot Area:
Answer:
Reference:
Question #5
You have an Azure subscription that contains an Azure Active Directory (Azure AD) tenant named
contoso.com and an Azure Kubernetes Service (AKS) cluster named AKS1.
 A. From contoso.com, modify the Organization relationships settings.

 B. From contoso.com, create an OAuth 2.0 authorization endpoint.
 C. Recreate AKS1.
 D. From AKS1, create a namespace.
Answer: B
Reference:
Question #6
You have a Microsoft 365 tenant and an Azure Active Directory (Azure AD) tenant named
contoso.com.
You plan to grant three users named User1, User2, and User3 access to a temporary Microsoft
SharePoint document library named Library1.
You need to create groups for the users. The solution must ensure that the groups are deleted
automatically after 180 days.
 A. a Microsoft 365 group that uses the Assigned membership type

 B. a Security group that uses the Assigned membership type
 C. a Microsoft 365 group that uses the Dynamic User membership type
 D. a Security group that uses the Dynamic User membership type
 E. a Security group that uses the Dynamic Device membership type
Answer: AC
Note: With the increase in usage of Office 365 Groups, administrators and users need a way to clean
up unused groups. Expiration policies can help remove inactive groups from the system and make
things cleaner.
When a group expires, all of its associated services (the mailbox, Planner, SharePoint site, etc.) are
also deleted.
Incorrect Answers:
Reference:
https://docs.microsoft.com/en-us/office365/admin/create-groups/office-365-groups-expiration-
policy?view=o365-worldwide
Question #7
HOTSPOT -
You have an Azure Active Directory (Azure AD) tenant named contoso.com that contains the users
shown in the following table:

Hot Area:
Answer:
Reference:
Question #8
HOTSPOT -

Hot Area:
Answer:
Box 1: No -
Box 2: Yes -
permissions.
Box 3: Yes -
permissions.
Reference:
https://docs.microsoft.com/en-us/azure/governance/management-groups/manage#moving-
management-groups-and-subscriptions
Question #9
 A. You are prevented from creating Azure SQL servers anywhere in Subscription 1.
 B. You can create Azure SQL servers in ContosoRG1 only.
 C. You are prevented from creating Azure SQL Servers in ContosoRG1 only.
 D. You can create Azure SQL servers in any resource group within Subscription 1.
Answer: B
ContosoRG1
Question #10
HOTSPOT -


Which tags apply to VNET1 and VNET2? To answer, select the appropriate options in the answer
area.
Hot Area:
Answer:

Note: Azure Policy allows you to use either built-in or custom-defined policy definitions and assign
them to either a specific resource group or across a whole
Azure subscription.
Incorrect Answers:
RGROUP: RG6 -
Reference:
Question #11
You have an Azure subscription named AZPT1 that contains the resources shown in the following
table:

 A. VM1, storage1, VNET1, and VM1Managed only

 B. VM1 and VM1Managed only
 C. VM1, storage1, VNET1, VM1Managed, and RVAULT1
 D. RVAULT1 only
Answer: C
You can move a VM and its associated resources to a different subscription by using the Azure
portal.
You can now move an Azure Recovery Service (ASR) Vault to either a new resource group within the
current subscription or to a new subscription.
Reference:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/move-resource-
group-and-subscription
Question #12
Admin1 attempts to deploy an Azure Marketplace resource by using an Azure Resource Manager
template. Admin1 deploys the template by using Azure
PowerShell and receives the following error message: .secruoser esahcrup ot noitadilav deliaf resU€‫ג‬
Error message: ‫ג‬€Legal terms have not been accepted for this item on this subscription. To accept
legal terms, please go to the Azure portal (http://go.microsoft.com/fwlink/?LinkId=534873) and
configure programmatic deployment for the Marketplace item or create it there for the first time.‫ג‬€
What should you do?
 A. From Azure PowerShell, run the Set-AzApiManagementSubscription cmdlet

 B. From the Azure portal, register the Microsoft.Marketplace resource provider
 C. From Azure PowerShell, run the Set-AzMarketplaceTerms cmdlet
 D. From the Azure portal, assign the Billing administrator role to Admin1
Answer: C
Reference:
https://docs.microsoft.com/en-us/powershell/module/az.marketplaceordering/set-
azmarketplaceterms?view=azps-4.1.0
Question #13
 A. From the Licenses blade, assign a new license

 B. From the Directory role blade, modify the directory role
 C. From the Groups blade, invite the user account to a new group
Answer: B
Assign a role to a user -
1. Sign in to the Azure portal with an account that's a global admin or privileged role admin for the
directory.
3. For the selected user, select Directory role, select Add role, and then pick the appropriate admin
roles from the Directory roles list, such as Conditional access administrator.
Reference:
assign-role-azure-portal
Question #14
What should you do?
 A. From the Licenses blade of Azure AD, assign a license

 B. From the Groups blade of each user, invite the users to a group
 C. From the Azure AD domain, add an enterprise application
 D. From the Directory role blade of each user, modify the directory role
Answer: A
Reference:
Question #15
You have an Azure subscription named Subscription1 and an on-premises deployment of Microsoft
System Center Service Manager.
You need to ensure that an alert is set in Service Manager when the amount of available memory on
VM1 is below 10 percent.
 A. Create an automation runbook

 B. Deploy a function app
 C. Deploy the IT Service Management Connector (ITSM)
 D. Create a notification
Answer: C
The IT Service Management Connector (ITSMC) allows you to connect Azure and a supported IT
Service Management (ITSM) product/service, such as the
With ITSMC, you can create work items in ITSM tool, based on your Azure alerts (metric alerts,
Activity Log alerts and Log Analytics alerts).
Reference:
Question #16
You need to add a user named admin1@contoso.com as an administrator on all the computers that
will be joined to the Azure AD domain.
 A. Device settings from the Devices blade

 B. Providers from the MFA Server blade
 C. User settings from the Users blade

 D. General settings from the Groups blade
Answer: A
When you connect a Windows device with Azure AD using an Azure AD join, Azure AD adds the
following security principles to the local administrators group on the device:
➨ The Azure AD global administrator role
➨ The Azure AD device administrator role
➨ The user performing the Azure AD join
In the Azure portal, you can manage the device administrator role on the Devices page. To open the
Devices page:
5. To modify the device administrator role, configure Additional local administrators on Azure AD
joined devices.
Reference:
Question #17
HOTSPOT -
Hot Area:
Answer:
Box 1: Yes -
Box 2: No -
Note: Azure AD registered devices utilize an account managed by the end user, this account is either
a Microsoft account or another locally managed credential.
Box 3: Yes -
Reference:
Question #18
RG26 is set to the West Europe location and is used to create temporary resources for a project.

 A. Delete VM1
 B. Stop VM1
 C. Stop the backup of SQLDB01
 D. Delete sa001
Answer: C
Question #19
You have an Azure subscription named Subscription1 that contains a virtual network named VNet1.
VNet1 is in a resource group named RG1.
➨ Reader
➨ Security Admin
Security Reader -
What should you do?
 A. Remove User1 from the Security Reader role for Subscription1. Assign User1 the Contributor role for
Subscription1.
 B. Assign User1 the Owner role for VNet1.
 C. Assign User1 the Network Contributor role for VNet1.
 D. Assign User1 the Network Contributor role for RG1.
Answer: B
Note:
There are several versions of this question in the exam. The question can have other incorrect
answer options, including the following:
1. Name Server (NS)
2. Assign User1 the Contributor role for VNet1.
3. Remove User1 from the Security Reader and Reader roles for Subscription1. Assign User1 the
Contributor role for Subscription1.
Reference:
Question #20
 A. MX
 B. NSEC
 C. PTR
 D. RRSIG
Answer: A
To verify your custom domain name (example)
1. Sign in to the Azure portal using a Global administrator account for the directory.
2. Select Azure Active Directory, and then select Custom domain names.
3. On the Fabrikam - Custom domain names page, select the custom domain name, Contoso.
4. On the Contoso page, select Verify to make sure your custom domain is properly registered and is
valid for Azure AD. Use either the TXT or the MX record type.
Note:
There are several versions of this question in the exam. The question can have two correct answer:
1. MX
2. TXT
The question can also have other incorrect answer options, including the following:
1. SRV
2. NSEC3
Reference:
Question #21
Subscription1. Adatum contains a group named Developers.
resource group.
 A. Yes
 B. No
Answer: B
DevTest Labs User role only lets you connect, start, restart, and shutdown virtual machines in your
Azure DevTest Labs.
The Logic App Contributor role lets you manage logic app, but not access to them. It provides access
to view, edit, and update a logic app.
Reference:
Question #22
resource group.
 A. Yes
 B. No
Answer: B
Reference:
Question #23
resource group.
 A. Yes
 B. No
Answer: A
Question #24
DRAG DROP -
You have an Azure subscription that is used by four departments in your company. The subscription
contains 10 resource groups. Each department uses resources in several resource groups.
You need to send a report to the finance department. The report must detail the costs for each
department.
Select and Place:
Answer:

You apply tags to your Azure resources giving metadata to logically organize them into a taxonomy.
After you apply tags, you can retrieve all the resources in your subscription with that tag name and
value. Each resource or resource group can have a maximum of 15 tag name/value pairs. Tags
applied to the resource group are not inherited by the resources in that resource group.
After you get your services running, regularly check how much they're costing you. You can see the
current spend and burn rate in Azure portal.
2. Click Cost analysis in the list to the left to see the cost breakdown by resource. Wait 24 hours after
you add a service for the data to populate.
3. You can filter by different properties like tags, resource group, and timespan. Click Apply to
confirm the filters and Download if you want to export the view to a
Comma-Separated Values (.csv) file.
Reference:
Question #25
You have an Azure subscription named Subscription1 that contains an Azure Log Analytics workspace
named Workspace1.
 A. Get-Event Event | where {$_.EventType == "error"}

 B. search in (Event) "error"
 C. select * from Event where EventType == "error"
 D. Get-Event Event | where {$_.EventTye ‫ג‬€"eq "error"}
Answer: B
Reference:
https://docs.microsoft.com/en-us/azure/data-
explorer/kusto/query/searchoperator?pivots=azuredataexplorer
Question #26
HOTSPOT -
You have an Azure subscription that contains a virtual network named VNET1 in the East US 2
region. A network interface named VM1-NI is connected to
VNET1.
You successfully deploy the following resources in an Azure Resource Manager template.
Hot Area:
Answer:
Box 1: Yes -
Box 2: Yes -
Box 3: No -
Reference:
Question #27
You have an Azure subscription named Subscription1. Subscription1 contains the resource groups in
 A. The App Service plan for WebApp1 remains in West Europe. Policy2 applies to WebApp1.
 B. The App Service plan for WebApp1 moves to North Europe. Policy2 applies to WebApp1.
 C. The App Service plan for WebApp1 remains in West Europe. Policy1 applies to WebApp1.
 D. The App Service plan for WebApp1 moves to North Europe. Policy1 applies to WebApp1.
Answer: A
You can move an app to another App Service plan, as long as the source plan and the target plan are
in the same resource group and geographical region.
The region in which your app runs is the region of the App Service plan it's in. However, you cannot
change an App Service plan's region.
Reference:
Question #28
HOTSPOT -
You have an Azure subscription named Subscription1 that has a subscription ID of c276fc76-9cd4-
44c9-99a7-4fd71546436e.
➨ Can be assigned only to the resource groups in Subscription1
➨Prevents the management of the access permissions for the resource groups
➨ Allows the viewing, creating, modifying, and deleting of resources within the resource groups
What should you specify in the assignable scopes and the permission elements of the definition of
CR1? To answer, select the appropriate options in the answer area.
Hot Area:
Answer:
Reference:
Question #29
Users access the resources in the subscription from either home or from customer sites. From home,
users must establish a point-to-site VPN to access the Azure resources. The users on the customer
sites access the Azure resources by using site-to-site VPNs.
You have a line-of-business-app named App1 that runs on several Azure virtual machine. The virtual
machines run Windows Server 2016.
What are two possible Azure services that you can use? Each correct answer presents a complete
solution.
 A. an internal load balancer

 B. a public load balancer
 C. an Azure Content Delivery Network (CDN)
 D. Traffic Manager
 E. an Azure Application Gateway
Answer: AE
Network traffic from the VPN gateway is routed to the cloud application through an internal load
balancer. The load balancer is located in the front-end subnet of the application.
Reference:
networking/vpn https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-overview
https://docs.microsoft.com/en-us/azure/application-gateway/overview
Question #30
You need to quickly identify underutilized virtual machines that can have their service tier changed
to a less expensive offering.
 A. Monitor
 B. Advisor
 C. Metrics
 D. Customer insights
Answer: B
Advisor helps you optimize and reduce your overall Azure spend by identifying idle and underutilized
resources. You can get cost recommendations from the Cost tab on the Advisor dashboard.
Reference:
Question #31
HOTSPOT -
Which three settings should you configure? To answer, select the appropriate settings in the answer
area.
Hot Area:
34
Answer:
Reference:
Question #32
following error message: ‫ג‬€Unable to invite user user1@outlook.com noitazirohtua cireneG "€‫ג‬
exception.‫ג‬€
What should you do?
 A. From the Users blade, modify the External collaboration settings.

 B. From the Custom domain names blade, add a custom domain.
 C. From the Organizational relationships blade, add an identity provider.
 D. From the Roles and administrators blade, assign the Security administrator role to Admin1.
Answer: A
Reference:
Question #33
You have an Azure subscription linked to an Azure Active Directory tenant. The tenant includes a
user account named User1.
What should you do?
 A. Assign the Owner role for the Azure Subscription to User1, and then modify the default conditional
access policies.
 B. Assign the Owner role for the Azure subscription to User1, and then instruct User1 to configure
access management for Azure resources.
 C. Assign the Global administrator role to User1, and then instruct User1 to configure access
management for Azure resources.
 D. Create a new management group and delegate User1 as the owner of the new management group.
Answer: C
Note:
Each directory is given a single top-level management group called the "Root" management group.
This root management group is built into the hierarchy to have all management groups and
subscriptions fold up to it. This root management group allows for global policies and Azure role
assignments to be applied at the directory level. The Azure AD Global Administrator needs to elevate
themselves to the User Access Administrator role of this root group initially. After elevating access,
the administrator can assign any Azure role to other directory users or groups to manage the
hierarchy. As administrator, you can assign your own account as owner of the root management
group.
Reference:
Question #34
HOTSPOT -
You have an Azure Active Directory (Azure AD) tenant named adatum.com. Adatum.com contains
the groups in the following table.
To which groups do User1 and User2 belong? To answer, select the appropriate options in the
answer area.
Hot Area:
95
Answer:
Box 1: Group 1 only -
First rule applies -
Box 2: Group1 and Group2 only -

Reference:
Question #35
HOTSPOT -
You have a hybrid deployment of Azure Active Directory (Azure AD) that contains the users shown in
For which users can you modify the attributes from Azure AD? To answer, select the appropriate
Hot Area:
Answer:
Box 1: User1 and User3 only -
You must use Windows Server Active Directory to update the identity, contact info, or job info for
users whose source of authority is Windows Server Active
Directory.
Box 2: User1, User2, and User3 -

Reference:
profile-azure-portal
Question #36
You need to ensure that an Azure Active Directory (Azure AD) user named Admin1 is assigned the
required role to enable Traffic Analytics for an Azure subscription.
 A. Yes
 B. No
Answer: A
Reference:
Question #37
 A. Yes
 B. No
Answer: A
Reference:
Question #38

 A. Yes
 B. No
Answer: A
Reference:
Question #39
You need to ensure that User1 can deploy virtual machines and manage virtual networks. The
solution must use the principle of least privilege.
 A. Owner
 B. Virtual Machine Contributor
 C. Contributor
 D. Virtual Machine Administrator Login
Answer: C
Virtual Machine Contributor: Lets you manage virtual machines, but not access to them, and not the
virtual network or storage account they're connected to.
Incorrect Answers:
A: Owner: Grants full access to manage all resources, including the ability to assign roles in Azure
RBAC.
C: Contributor: Grants full access to manage all resources, but does not allow you to assign roles in
Azure RBAC.
D: Virtual Machine Administrator Login: View Virtual Machines in the portal and login as
administrator.
Reference:
Question #40
HOTSPOT -
You have an Azure Active Directory (Azure AD) tenant that contains three global administrators
named Admin1, Admin2, and Admin3.
The tenant is associated to an Azure subscription. Access control for the subscription is configured as
shown in the Access control exhibit. (Click the Access
Control tab.)
You sign in to the Azure portal as Admin1 and configure the tenant as shown in the Tenant exhibit.
(Click the Tenant tab.)
Hot Area:
Answer:
Box 1: No -
Only Admin3, the owner, can assign ownership.
Box 2: Yes -
Box 3: No -
Reference:
https://docs.microsoft.com/en-us/azure/cost-management-billing/manage/add-change-
subscription-administrator
Question #41
You have an Azure subscription named Subscription1 that contains an Azure virtual machine named
VM1. VM1 is in a resource group named RG1.
You need to ensure that a service running on VM1 can manage the resources in RG1 by using the
identity of VM1.
 A. From the Azure portal, modify the Managed Identity settings of VM1
 B. From the Azure portal, modify the Access control (IAM) settings of RG1
 C. From the Azure portal, modify the Access control (IAM) settings of VM1
 D. From the Azure portal, modify the Policies settings of RG1
Answer: A
Managed identities for Azure resources provides Azure services with an automatically managed
identity in Azure Active Directory. You can use this identity to authenticate to any service that
supports Azure AD authentication, without having credentials in your code.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/qs-
configure-portal-windows-vm
Question #42

 A. Modify the backup configurations of VM1 and modify the resource lock type of VNET1
 B. Remove the resource lock from VNET1 and delete all data in Vault1
 C. Turn off VM1 and remove the resource lock from VNET1
 D. Turn off VM1 and delete all data in Vault1
Answer: B
When you delete a resource group, all of its resources are also deleted. Deleting a resource group
deletes all of its template deployments and currently stored operations.
Reference:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/delete-resource-
group?tabs=azure-powershell
Question #43
What should you do?
 A. Create an NS record named research in the adatum.com zone.

 B. Create an PTR record named research in the adatum.com zone.
 C. Modify the SOA record of adatum.com.
 D. Create an A record named *.research in the adatum.com zone.
Answer: A
Reference:
Question #44
DRAG DROP -
You have an Azure Active Directory (Azure AD) tenant that has the contoso.onmicrosoft.com domain
name.
You need to ensure that you can create Azure AD users that have names containing a suffix of
@contoso.com.
Select and Place:
Answer:

Reference:
- Question Set 2
Question #1
named contosodata.
 A. https://contosodata.blob.core.windows.net/public
 B. azcopy sync D:\folder1 https://contosodata.blob.core.windows.net/public --snapshot
 C. azcopy copy D:\folder1 https://contosodata.blob.core.windows.net/public --recursive
 D. az storage blob copy start-batch D:\Folder1 https://contosodata.blob.core.windows.net/public
Answer: C
Incorrect Answers:
Reference:
Question #41
You have an Azure subscription named Subscription1 that contains an Azure virtual machine named
VM1. VM1 is in a resource group named RG1.
You need to ensure that a service running on VM1 can manage the resources in RG1 by using the
identity of VM1.
 A. From the Azure portal, modify the Managed Identity settings of VM1
 B. From the Azure portal, modify the Access control (IAM) settings of RG1
 C. From the Azure portal, modify the Access control (IAM) settings of VM1
 D. From the Azure portal, modify the Policies settings of RG1
Answer: A
Managed identities for Azure resources provides Azure services with an automatically managed
identity in Azure Active Directory. You can use this identity to authenticate to any service that
supports Azure AD authentication, without having credentials in your code.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/qs-
configure-portal-windows-vm
Question #42

 A. Modify the backup configurations of VM1 and modify the resource lock type of VNET1
 B. Remove the resource lock from VNET1 and delete all data in Vault1
 C. Turn off VM1 and remove the resource lock from VNET1
 D. Turn off VM1 and delete all data in Vault1
Answer: B
When you delete a resource group, all of its resources are also deleted. Deleting a resource group
deletes all of its template deployments and currently stored operations.
Reference:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/delete-resource-
group?tabs=azure-powershell
Question #43
What should you do?
 A. Create an NS record named research in the adatum.com zone.

 B. Create an PTR record named research in the adatum.com zone.
 C. Modify the SOA record of adatum.com.
 D. Create an A record named *.research in the adatum.com zone.
Answer: A
Reference:
Question #44
DRAG DROP -
You have an Azure Active Directory (Azure AD) tenant that has the contoso.onmicrosoft.com domain
name.
You need to ensure that you can create Azure AD users that have names containing a suffix of
@contoso.com.
Select and Place:
Answer:

Reference:
- Question Set 2
Question #1
named contosodata.
 A. https://contosodata.blob.core.windows.net/public
 B. azcopy sync D:\folder1 https://contosodata.blob.core.windows.net/public --snapshot
 C. azcopy copy D:\folder1 https://contosodata.blob.core.windows.net/public --recursive
 D. az storage blob copy start-batch D:\Folder1 https://contosodata.blob.core.windows.net/public
Answer: C
Incorrect Answers:
Reference:
Question #2
You have an Azure subscription named Subscription1 that contains the storage accounts shown in
 A. storage1
 B. storage2
 C. storage3
 D. storage4
Answer: D
➨ Standard General Purpose v2 storage accounts (recommended for most scenarios)
➨ Blob Storage accounts
➨ General Purpose v1 storage accounts (both Classic or Azure Resource Manager deployments),
➨ Import supports Azure Blob storage and Azure File storage
➨ Export supports Azure Blob storage
Reference:
Question #3
HOTSPOT -
Hot Area:
Answer:
Box 2: All the storage accounts -

General-purpose v1 (GPv1) accounts, and Blob storage accounts.
➨ General-purpose v2 (GPv2) accounts are storage accounts that support all of the latest features
for blobs, files, queues, and tables.
➨ Blob storage accounts support all the same block blob features as GPv2, but are limited to
➨ General-purpose v1 (GPv1) accounts provide access to all Azure Storage services, but may not
Reference:
Question #4
 A. DB1
 B. container1
 C. Share1
 D. Table1
Answer: B
Question #5
HOTSPOT -
You have an Azure Service app named App1 and an app named App2 that runs in an Azure container
instance. Each app uses a managed identity.
You need to ensure that App1 and App2 can read blobs from storage1. The solution must meet the
following requirements:
✑ Minimize the number of secrets used.
✑ Ensure that App2 can only read from storage1 for the next 30 days.
What should you configure in storage1 for each app? To answer, select the appropriate options in
the answer area.
Hot Area:
Answer:
App1: Access keys -

A shared access signature (SAS) provides secure delegated access to resources in your storage
account without compromising the security of your data. With a
SAS, you have granular control over how a client can access your data. You can control what
resources the client may access, what permissions they have on those resources, and how long the
SAS is valid, among other parameters.
Reference:
Question #6
HOTSPOT -
➨ Minimizes costs
➨ Supports hot, cool, and archive blob tiers
➨ Provides fault tolerance if a disaster affects the Azure region where the account resides
How should you complete the command? To answer, select the appropriate options in the answer
area.
Hot Area:
Answer:
Box 1: StorageV2 -
You may only tier your object storage data to hot, cool, or archive in Blob storage and General
Purpose v2 (GPv2) accounts. General Purpose v1 (GPv1) accounts do not support tiering.
General-purpose v2 accounts deliver the lowest per-gigabyte capacity prices for Azure Storage, as
well as industry-competitive transaction prices.
Box 2: Standard_GRS -
Geo-redundant storage (GRS): Cross-regional replication to protect against region-wide
unavailability.
Incorrect Answers:
Locally-redundant storage (LRS): A simple, low-cost replication strategy. Data is replicated within a
single storage scale unit.
Read-access geo-redundant storage (RA-GRS): Cross-regional replication with read access to the
replica. RA-GRS provides read-only access to the data in the secondary location, in addition to geo-
replication across two regions, but is more expensive compared to GRS.
Reference:
Question #7
You need to synchronize the files in the file share named data to an on-premises server named
Server1.
 A. Create a container instance

 B. Register Server1
 C. Install the Azure File Sync agent on Server1
 D. Download an automation script
 E. Create a sync group
Answer: BCE
The Azure File Sync agent is a downloadable package that enables Windows Server to be synced with
an Azure file share
A sync group defines the sync topology for a set of files. Endpoints within a sync group are kept in
sync with each other. A sync group must contain one cloud endpoint, which represents an Azure file
share and one or more server endpoints. A server endpoint represents a path on registered server.
Reference:
Question #8
HOTSPOT -


Hot Area:
Answer:
Question #9
DRAG DROP -
You have an on-premises server named Server1 that runs Windows Server 2016. Server1 has 2 TB of
data.
In which order should you perform the actions? To answer, move all actions from the list of actions
to the answer area and arrange them in the correct order.
Select and Place:
Answer:

Determine data to be imported, number of drives you need, destination blob location for your data
in Azure storage.
Reference:
Question #10
HOTSPOT -
You create a Storage Sync Service named Sync1 and an Azure File Sync group named Group1.
Group1 uses share1 as a cloud endpoint.
You register Server1 and Server2 in Sync1. You add D:\Folder1 on Server1 as a server endpoint of
Group1.
Hot Area:
Answer:
Box 1: No -
Box 2: Yes -
Box 3: Yes -
Reference:
Question #11
DRAG DROP -
You create an Azure Storage account named contosostorage, and then you create a file share named
data.
answer, drag the appropriate values to the correct targets. Each value may be used once, more than
once or not at all. You may need to drag the split bar between panes or scroll to view content.
Select and Place:
Answer:
Box 1: contosostorage -
The name of account -
Box 2: file.core.windows.net -
Box 3: data -
Example:
Reference:
Question #12
HOTSPOT -
Hot Area:
Answer:
Question #13
HOTSPOT -

On which endpoints will File1 and File2 be available within 24 hours of adding the files? To answer,
Hot Area:
Answer:
File1: Endpoint3 only -

Cloud Tiering: A switch to enable or disable cloud tiering. When enabled, cloud tiering will tier files
to your Azure file shares. This converts on-premises file shares into a cache, rather than a complete
copy of the dataset, to help you manage space efficiency on your server. With cloud tiering,
infrequently used or accessed files can be tiered to Azure Files.
Reference:
Question #14
HOTSPOT -
Hot Area:
Answer:
Box 1: always -
Box 2: Never -
After you configure firewall and virtual network settings for your storage account, select Allow
trusted Microsoft services to access this storage account as an exception to enable Azure Backup
service to access the network restricted storage account.
Reference:
https://azure.microsoft.com/en-us/blog/azure-backup-now-supports-storage-accounts-secured-
with-azure-storage-firewalls-and-virtual-networks/
Question #15
HOTSPOT -
You have a sync group named Sync1 that has a cloud endpoint. The cloud endpoint includes a file
named File1.txt.
Your on-premises network contains servers that run Windows Server 2016. The servers are
configured as shown in the following table.
Hot Area:
Answer:
Box 1: Yes -
If you add an Azure file share that has an existing set of files as a cloud endpoint to a sync group, the
existing files are merged with any other files that are already on other endpoints in the sync group.
Box 2: No -
Box 3: Yes -
Reference:
Question #16
You need to identify which storage account can be converted to zone-redundant storage (ZRS)
replication by requesting a live migration from Azure support.
 A. storage1
 B. storage2
 C. storage3
 D. storage4
Answer: B
ZRS currently supports standard general-purpose v2, FileStorage and BlockBlobStorage storage
account types.
Incorrect Answers:
A, not C: Live migration is supported only for storage accounts that use LRS replication. If your
account uses GRS or RA-GRS, then you need to first change your account's replication type to LRS
before proceeding. This intermediary step removes the secondary endpoint provided by GRS/RA-
GRS.
Also, only standard storage account types support live migration. Premium storage accounts must be
migrated manually.
D: ZRS currently supports standard general-purpose v2, FileStorage and BlockBlobStorage storage
account types.
Reference:
Question #17
You plan to upload the disk files of a virtual machine to account1 from your on-premises network.
The on-premises network uses a public IP address space of
131.107.1.0/24.
You plan to use the disk files to provision an Azure virtual machine named VM1. VM1 will be
attached to a virtual network named VNet1. VNet1 uses an IP address space of 192.168.0.0/24.
➨ Ensure that you can upload the disk files to account1.
➨ Ensure that you can attach the disks to VM1.
➨ Prevent all other access to account1.
 A. From the Firewalls and virtual networks blade of account1, select Selected networks.
 B. From the Firewalls and virtual networks blade of account1, select Allow trusted Microsoft services to
 C. From the Firewalls and virtual networks blade of account1, add the 131.107.1.0/24 IP address
range.
 D. From the Firewalls and virtual networks blade of account1, add VNet1.
 E. From the Service endpoints blade of VNet1, add a service endpoint.
Answer: AC
A: By default, storage accounts accept connections from clients on any network. To limit access to
selected networks, you must first change the default action.
Azure portal -
3. To deny access by default, choose to allow access from 'Selected networks'. To allow traffic from
all networks, choose to allow access from 'All networks'.
By enabling a Service Endpoint for Azure Storage within the Virtual Network, traffic is ensured an
optimal route to the Azure Storage service. The identities of the virtual network and the subnet are
also transmitted with each request.
Reference:
Question #18
DRAG DROP -
Select and Place:
Select and Place:

Answer:

an Azure file share
Step 3: Add a server endpoint -


A sync group defines the sync topology for a set of files. Endpoints within a sync group are kept in
sync with each other. A sync group must contain one cloud endpoint, which represents an Azure file
share and one or more server endpoints. A server endpoint represents a path on registered server.
Reference:
Question #19
HOTSPOT -
➨ Replicates synchronously.
➨ Remains available if a single data center in the region fails.
How should you configure the storage account? To answer, select the appropriate options in the
answer area.
Hot Area:
Hot Area:
Answer:
Answer:
Zone-redundant storage (ZRS) replicates your data synchronously across three storage clusters in a
single region.
Reference:
Question #20
 A. an XML manifest file

 B. a dataset CSV file
 C. a JSON configuration file
 D. a PowerShell PS1 file
 E. a driveset CSV file
Answer:BE
D: Modify the dataset.csv file in the root folder where the tool resides. Depending on whether you
Reference:
Question #21
 A. From the Recovery Service vault, delete the backup data.

 B. Modify the disaster recovery properties of each virtual machine.
 C. Modify the locks of each virtual machine.
 D. From the Recovery Service vault, stop the backup of each backup item.
Answer: D
You can't delete a Recovery Services vault if it is registered to a server and holds backup data. If you
try to delete a vault, but can't, the vault is still configured to receive backup data.

In the vault dashboard menu, scroll down to the Protected Items section, and click Backup Items. In
this menu, you can stop and delete Azure File Servers, SQL
Servers in Azure VM, and Azure virtual machines.
Reference:
Question #22
HOTSPOT -
following table.
Which resources can be backed up to Vault1 and Vault2? To answer, select the appropriate options
in the answer area.
Hot Area:
Answer:
Box 1: VM1 only -
Note: To create a vault to protect virtual machines, the vault must be in the same region as the
virtual machines.
Box 2: Share1 only.
Note: After you select Backup, the Backup pane opens and prompts you to select a storage account
from a list of discovered supported storage accounts. They're either associated with this vault or
present in the same region as the vault, but not yet associated to any Recovery Services vault.
Reference:
https://docs.microsoft.com/en-us/azure/backup/backup-afs
Question #23
 A. a virtual machine
 B. an Azure Cosmos DB database
 C. Azure File Storage
 D. the Azure File Sync Storage Sync Service
Answer: C
Azure Import/Export service is used to securely import large amounts of data to Azure Blob storage
and Azure Files by shipping disk drives to an Azure datacenter.

Note:
➨ Azure Data Lake Store
➨ Azure SQL Database
➨ Azure Data Factory
Reference:
C (100%)
Question #24
HOTSPOT -
Hot Area:
Answer:
Box 1: 3 -
Locally Redundant Storage (LRS) provides highly durable and available storage within a single
location (sub region). We maintain an equivalent of 3 copies
(replicas) of your data within the primary location as described in our SOSP paper; this ensures that
we can recover from common failures (disk, node, rack) without impacting your storage account's
availability and durability.
Box 2: Access tier -

Note: Azure storage offers different access tiers, which allow you to store blob object data in the
most cost-effective manner. The available access tiers include:
Hot - Optimized for storing data that is accessed frequently.
Cool - Optimized for storing data that is infrequently accessed and stored for at least 30 days.
Archive - Optimized for storing data that is rarely accessed and stored for at least 180 days with
flexible latency requirements (on the order of hours).
Reference:
https://azure.microsoft.com/en-us/blog/data-series-introducing-locally-redundant-storage-for-
windows-azure-storage/ https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-
storage-tiers
Question #25
 A. blob, file, table, and queue

 B. blob and file only
 C. file and table only
 D. file only
 E. blob, table, and queue only
Answer: B
Incorrect Answers:
Reference:
Question #26
HOTSPOT -
You have an Azure Storage account named storage1 that uses Azure Blob storage and Azure File
storage.
Which authentication method should you use for each type of storage? To answer, select the
Hot Area:
Answer:
You can provide authorization credentials by using Azure Active Directory (AD), or by using a Shared
Access Signature (SAS) token.
Box 1:
Both Azure Active Directory (AD) and Shared Access Signature (SAS) token are supported for Blob
storage.
Box 2:
Reference:
Question #27
You plan to create an Azure container instance named container1 that will use a Docker image
named Image1. Image1 contains a Microsoft SQL Server instance that requires persistent storage.
 A. Azure Files
 B. Azure Blob storage
 C. Azure Queue storage
 D. Azure Table storage
Answer: A
Question #28
You plan to implement an Azure Availability Set for App1. The solution must ensure that App1 is
available during planned maintenance of the hardware hosting
VM1 and VM2.
 A. one update domain

 B. two fault domains
 C. one fault domain

 D. two update domains
Answer: D
Microsoft updates, which Microsoft refers to as planned maintenance events, sometimes require
that VMs be rebooted to complete the update. To reduce the impact on VMs, the Azure fabric is
divided into update domains to ensure that not all VMs are rebooted at the same time.
Incorrect Answers:
A: An update domain is a group of VMs and underlying physical hardware that can be rebooted at
the same time.
B, C: A fault domain shares common storage as well as a common power source and network switch.
It is used to protect against unplanned system failure.
References:
Question #29
 A. an Azure Cosmos DB database

 B. Azure Blob storage
 C. Azure Data Lake Store
 D. the Azure File Sync Storage Sync Service
Answer: B
Azure Import/Export service is used to securely import large amounts of data to Azure Blob storage
and Azure Files by shipping disk drives to an Azure datacenter.
Note:
➨ a virtual machine
➨Azure SQL Database
➨ Azure Data Factory
Reference:
Question #30
DRAG DROP -
You have an on-premises server named Server1 that runs Windows Server 2016.
You plan to set up Azure File Sync between Server1 and the Azure file share.
You need to prepare the subscription for the planned Azure File Sync.
Which two actions should you perform in the Azure subscription? To answer, drag the appropriate
actions to the correct targets. Each action may be used once, more than once, or not at all. You may
need to drag the split bar between panes or scroll to view content.

Select and Place:
Answer:
First action: Create a Storage Sync Service

The deployment of Azure File Sync starts with placing a Storage Sync Service resource into a
resource group of your selected subscription.
Second action: Install the Azure File Sync agent
an Azure file share.
Reference:
Question #31
HOTSPOT -
You have an Azure subscription that contains the file shares shown in the following table.
You have the on-premises file shares shown in the following table.
You create an Azure file sync group named Sync1 and perform the following actions:
➨ Add share1 as the cloud endpoint for Sync1.
➨ Add data1 as a server endpoint for Sync1.
➨Register Server1 and Server2 to Sync1.
Hot Area:
Answer:
Box 1: No -
Box 2: Yes -
Data2 is located on Server2 which is registered to Sync1.
Box 3: No -
Data3 is located on Server3 which is not registered to Sync1.

Reference:
https://docs.microsoft.com/en-us/azure/storage/files/storage-sync-files-deployment-
guide?tabs=azure-portal%2Cproactive-portal#create-a-sync-group-and-a- cloud-endpoint
Question #32
HOTSPOT -
following table:

Which storage accounts and which Log Analytics workspaces can you use for the Azure Backup
reports of Vault1? To answer, select the appropriate options in the answer area.
Hot Area:
Answer:
Box 1: storage3 only -

Box 2: Analytics3 -
Reference:
Question #33
HOTSPOT -
You have an Azure subscription that contains the storage accounts shown in the following exhibit.
Hot Area:
Answer:
Box 1: contoso104 only -

Premium file shares are hosted in a special purpose storage account kind, called a FileStorage
account.
Box 2: contoso101, contoso102, and contos103 only
Reference:
https://docs.microsoft.com/en-us/azure/storage/files/storage-how-to-create-premium-
fileshare?tabs=azure-portal https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-
storage-tiers
Question #34
HOTSPOT -

Hot Area:
Answer:
Box 1: Will have no access -

Reference:
https://docs.microsoft.com/en-us/azure/storage/common/storage-dotnet-shared-access-signature-
part-1 https://docs.microsoft.com/en-us/azure/vs-azure-tools-storage-manage-with-storage-
explorer?tabs=windows
Question #35
You have two Azure virtual machines named VM1 and VM2. You have two Recovery Services vaults
named RSV1 and RSV2.
VM2 is backed up to RSV1.
You need to back up VM2 to RSV2.
 A. From the RSV1 blade, click Backup items and stop the VM2 backup
 B. From the RSV2 blade, click Backup. From the Backup blade, select the backup for the virtual
machine, and then click Backup
 C. From the VM2 blade, click Disaster recovery, click Replication settings, and then select RSV2 as the
Recovery Services vault
 D. From the RSV1 blade, click Backup Jobs and export the VM2 job
Answer: A
Reference:
Question #36
You have a general-purpose v1 Azure Storage account named storage1 that uses locally-redundant
storage (LRS).
You need to ensure that the data in the storage account is protected if a zone fails. The solution
must minimize costs and administrative effort.
 A. Create a new storage account.

 B. Configure object replication rules.
 C. Upgrade the account to general-purpose v2.
 D. Modify the Replication setting of storage1.
Answer: C
Reference:
Question #37
 A. storage1 only
 B. storage1 and storage2 only
 C. storage3 and storage4 only
 D. storage1, storage2, and storage3 only
 E. storage1, storage2, storage3, and storage4
Answer: D
Reference:
https://docs.microsoft.com/en-us/azure/storage/blobs/storage-lifecycle-management-
concepts?tabs=azure-portal
- Question Set 3
Question #1
Solution: You create an Azure Log Analytics workspace and configure the data settings. You add the
Microsoft Monitoring Agent VM extension to VM1. You create an alert in Azure Monitor and specify

 A. Yes
 B. No
Answer: B
Microsoft Monitoring Agent on VM1. You create an alert in
Reference:
Question #2
Solution: You create an Azure Log Analytics workspace and configure the data settings. You install
the Microsoft Monitoring Agent on VM1. You create an alert in
 A. Yes
 B. No
Answer: A
Alerts in Azure Monitor can identify important information in your Log Analytics repository. They are
created by alert rules that automatically run log searches at regular intervals, and if results of the log
search match particular criteria, then an alert record is created and it can be configured to perform
an automated response.
The Log Analytics agent collects monitoring data from the guest operating system and workloads of
virtual machines in Azure, other cloud providers, and on- premises. It collects data into a Log
Reference:
Question #3
Solution: You create an Azure storage account and configure shared access signatures (SASs). You
install the Microsoft Monitoring Agent on VM1. You create an alert in Azure Monitor and specify the
storage account as the source.
 A. Yes
 B. No
Answer: B
Reference:
Question #4
HOTSPOT -
You have an Azure subscription named Subscription1. Subscription1 contains the resources in the
following table.
An administrator named Admin1 creates an Azure virtual machine named VM1 in RG1. VM1 uses a
disk named Disk1 and connects to VNet1. Admin1 then installs a custom application in VM1.
effort.
area.
Hot Area:
Answer:
Reference:
vnet-on-azure/ https://4sysops.com/archives/move-an-azure-vm-to-another-virtual-network-
vnet/#migrate-an-azure-vm-between-vnets
Question #37
Answer: D
Reference:
- Question Set 3
Question #1

 A. Yes
 B. No
Answer: B
Reference:
Question #2
 A. Yes
 B. No
Answer: A
Reference:
Question #3
 A. Yes
 B. No
Answer: B
Reference:
Question #4
HOTSPOT -
following table.
effort.
area.
Hot Area:
Answer:
Reference:
Question #37
Answer: D
Reference:
- Question Set 3
Question #1
 A. Yes
 B. No
Answer: B
Reference:
Question #2
 A. Yes
 B. No
Answer: A
Reference:
Question #3
 A. Yes
 B. No
Answer: B
Reference:
Question #4
HOTSPOT -
following table.
effort.
area.
Hot Area:
Answer:
Reference:
Question #37
Answer: D
Reference:
- Question Set 3
Question #1
 A. Yes
 B. No
Answer: B
Reference:
Question #2
 A. Yes
 B. No
Answer: A
Reference:
Question #3
 A. Yes
 B. No
Answer: B
Reference:
Question #4
HOTSPOT -
following table.
effort.
area.
Hot Area:
Answer:
Reference:
Question #37
Answer: D
Reference:
Question #1
 A. Yes
 B. No
Answer: B
Reference:
Question #2
 A. Yes
 B. No
Answer: A
Reference:
Question #3

 A. Yes
 B. No
Answer: B
Reference:
Question #4
HOTSPOT -
following table.
effort.
area.
Hot Area:
Answer:
Reference:
Question #37
Answer: D
Reference:
- Question Set 3
Question #1
 A. Yes
 B. No
Answer: B
Reference:
Question #2
 A. Yes
 B. No
Answer: A
Reference:
Question #3
 A. Yes
 B. No
Answer: B
Reference:
Question #4
HOTSPOT -
following table.
effort.
area.
Hot Area:
Answer:
Reference:
Question #5
template will be used to deploy 100 virtual machines.
You need to modify the template to reference an administrative password. You must prevent the
password from being stored in plain text.
 A. an Azure Key Vault and an access policy

 B. an Azure Storage account and an access policy
 C. a Recovery Services vault and a backup policy
 D. Azure Active Directory (AD) Identity Protection and an Azure policy
Answer: A
You can use a template that allows you to deploy a simple Windows VM by retrieving the password
that is stored in a Key Vault. Therefore, the password is never put in plain text in the template
parameter file.
Reference:
Question #6
HOTSPOT -
Hot Area:
Answer:
Box 1: ASP1 ASP3 -
Box 2: ASP1 -

Reference:
Question #7
HOTSPOT -
You create a virtual machine scale set named Scale1. Scale1 is configured as shown in the following
exhibit.
Hot Area:
Answer:
Box 1: 6 virtual machines -

The Autoscale scale out rule increases the number of VMs by 2 if the CPU threshold is 80% or higher.
The initial instance count is 4 and rises to 6 when the 2 extra instances of VMs are added.
Box 2: 2 virtual machnes -

The Autoscale scale in rule decreases the number of VMs by 4 if the CPU threshold is 30% or lower.
The initial instance count is 4 and thus cannot be reduced to
0 as the minimum instances is set to 2. Instances are only added when the CPU threshold reaches
80%.
Reference:
Question #8
You plan to automate the deployment of a virtual machine scale set that uses the Windows Server
2016 Datacenter image.
You need to ensure that when the scale set virtual machines are provisioned, they have web server
components installed.
 A. Upload a configuration script

 B. Create an automation account
 C. Create an Azure policy
 D. Modify the extensionProfile section of the Azure Resource Manager template
 E. Create a new virtual machine scale set in the Azure portal
Answer: AD
Virtual Machine Scale Sets can be used with the Azure Desired State Configuration (DSC) extension
handler. Virtual machine scale sets provide a way to deploy and manage large numbers of virtual
machines, and can elastically scale in and out in response to load. DSC is used to configure the VMs
as they come online so they are running the production software.
Reference:
Question #9
HOTSPOT -
You have an Azure Kubernetes Service (AKS) cluster named AKS1 and a computer named Computer1
that runs Windows 10. Computer1 that has the Azure CLI installed.
Hot Area:
Answer:
To install kubectl locally, use the az aks install-cli command: az aks install-cli
Reference:
Question #10
DRAG DROP -
You need to use Azure Automation State Configuration to manage the ongoing consistency of the
virtual machine configurations.
Select and Place:
Answer:

A DSC configuration defining that state must be compiled into one or more node configurations
(MOF document), and placed on the Automation DSC Pull Server.
Each time Azure Automation State Configuration performs a consistency check on a managed node,
the node sends a status report back to the pull server. You can view these reports on the page for
that node.
On the blade for an individual report, you can see the following status information for the
corresponding consistency check:
The report status ‫ג‬€" whether the node is "Compliant", the configuration "Failed", or the node is
"Not Compliant"
Reference:
Question #11
You have an Azure Resource Manager template named Template1 that is used to deploy an Azure
virtual machine.

What should you do?
 A. Modify the location in the resources section to westus

 B. Select West US during the deployment
 C. Modify the location in the variables section to westus
Answer: A
Question #12
 A. From Plan1, scale up the App Service plan

 B. From webapp1, modify the Application settings
 C. From webapp1, add a custom domain
 D. From Plan1, scale out the App Service plan
Answer: A
The app must be running in the Standard, Premium, or Isolated tier in order for you to enable
multiple deployment slots.
If the app isn't already in the Standard, Premium, or Isolated tier, you receive a message that
indicates the supported tiers for enabling staged publishing. At this point, you have the option to
select Upgrade and go to the Scale tab of your app before continuing.
Scale up: Get more CPU, memory, disk space, and extra features like dedicated virtual machines
(VMs), custom domains and certificates, staging slots, autoscaling, and more.
Incorrect:
Scale out: Increase the number of VM instances that run your app. You can scale out to as many as
30 instances
Reference:
Question #13
You need to ensure that App1 always runs on at least eight virtual machines during planned Azure
maintenance.
 A. one virtual machine scale set that has 10 virtual machines instances
 B. one Availability Set that has three fault domains and one update domain
 C. one Availability Set that has 10 update domains and one fault domain
 D. one virtual machine scale set that has 12 virtual machines instances
Answer: A
An update domain is a logical group of underlying hardware that can undergo maintenance or be
rebooted at the same time. As you create VMs within an availability set, the Azure platform
automatically distributes your VMs across these update domains. This approach ensures that at least
one instance of your application always remains running as the Azure platform undergoes periodic
maintenance.
Reference:
Question #14
Solution: You create an event subscription on VM1. You create an alert in Azure Monitor and specify
VM1 as the source
 A. Yes
 B. No
Answer: B
Reference:
Question #15
 A. Yes
 B. No
Answer: B
Reference:
Question #16
 A. Yes
 B. No
Answer: A
References:
Question #17
 A. Yes
 B. No
Answer: B
Reference:
Question #18
You have an Azure subscription that contains a web app named webapp1.
You need to add a custom domain named www.contoso.com to webapp1.
 A. Create a DNS record

 B. Add a connection string
 C. Upload a certificate.
 D. Stop webapp1.
Answer: A
You can use either a CNAME record or an A record to map a custom DNS name to App Service.
Reference:
https://docs.microsoft.com/en-us/Azure/app-service/app-service-web-tutorial-custom-domain
Question #19

 A. Yes
 B. No
Answer: B
Note: When you create an Azure virtual machine (VM), you must create a virtual network (VNet) or
use an existing VNet. You can change the subnet a VM is connected to after it's created, but you
cannot change the VNet.
Reference:
Question #20

Solution: You delete VM1. You recreate VM1, and then you create a new network interface for VM1
and connect it to VNET2.
 A. Yes
 B. No
Answer: A
Reference:
Question #21

 A. Yes
 B. No
Answer: B
Reference:
Question #22
HOTSPOT -
You have an Azure subscription named Subscription1 that contains the quotas shown in the
following table.
You deploy virtual machines to Subscription1 as shown in the following table.
Hot Area:
Answer:
The total regional vCPUs is 20 so that means a maximum total of 20 vCPUs across all the different
VM sizes. The deallocated VM with 16 vCPUs counts towards the total. VM20 and VM1 are using 18
of the maximum 20 vCPUs leaving only two vCPUs available.
Reference:
Question #23
HOTSPOT -
You have an Azure subscription that contains an Azure Availability Set named WEBPROD-AS-USE2 as
shown in the following exhibit.

Hot Area:
Answer:
Box 1: 2 -
There are 10 update domains. The 14 VMs are shared across the 10 update domains so four update
domains will have two VMs and six update domains will have one VM. Only one update domain is
rebooted at a time. Therefore, a maximum of two VMs will be offline.
Box 2: 7 -
There are 2 fault domains. The 14 VMs are shared across the 2 fault domains, so 7 VMs in each fault
domain. A rack failure will affect one fault domain so 7 VMs will be offline.
Reference:
N https://docs.microsoft.com/en-us/azure/virtual-
machines/windows/manage-availability
Question #24
You deploy an Azure Kubernetes Service (AKS) cluster named Cluster1 that uses the IP addresses
 A. 131.107.2.1
 B. 10.0.10.11
 C. 172.17.7.1
 D. 192.168.10.2
Answer: A
Question #25
You need to identify what to deploy before you deploy Template1. The solution must minimize
Azure costs.
 A. five Azure Application Gateways

 B. one App Service plan
 C. 10 App Service plans
 D. one Azure Traffic Manager
 E. one Azure Application Gateway
Answer: B
Reference:
Question #26
HOTSPOT -
You plan to deploy an Azure container instance by using the following Azure Resource Manager
template.
Hot Area:
Answer:
Question #27
business application that is available 24 hours a day. VM1 has one network interface and one
managed disk. VM1 uses the D4s v3 size.
➨ Change the size to D8s v3.
➨ Add a 500-GB managed disk.
➨ Add the Puppet Agent extension.
➨ Enable Desired State Configuration Management.
 A. Enable Desired State Configuration Management

 B. Add a 500-GB managed disk
 C. Change the size to D8s v3
 D. Add the Puppet Agent extension
Answer: C
Reference:
Question #28
 A. Swap the slots

 B. Deploy the App1 update to webapp1-prod, and then test the update
 C. Stop webapp1-prod
 D. Deploy the App1 update to webapp1-test, and then test the update
 E. Stop webapp1-test
Answer: AD
Question #29
➨Authorization
➨ Automation
➨ Resources
➨Compute
➨ KeyVault
➨ Network
➨ Storage
➨ Billing
➨ Web
➨ Private IP address: 10.0.0.4 (dynamic)
➨ Network security group (NSG): NSG1
➨Public IP address: None
➨ Availability set: AVSet
➨ Subnet: 10.0.0.0/24
➨ Managed disks: No
Location: East US -
 A. Enable Azure Network Watcher in the East US Azure region.

 B. Add an Azure Network Watcher connection monitor.

 C. Register the MicrosoftLogAnalytics provider.
 D. Create an Azure Storage account.
 E. Register the Microsoft.Insights resource provider.
 F. Enable Azure Network Watcher flow logs.
Answer: AEF
D: NSG flow log data is written to an Azure Storage account. You need to create an Azure Storage
account,
Reference:
Question #30
You need to deploy an Azure virtual machine scale set that contains five instances as quickly as
possible.
What should you do?
 A. Deploy five virtual machines. Modify the Availability Zones settings for each virtual machine.
 B. Deploy five virtual machines. Modify the Size setting for each virtual machine.
 C. Deploy one virtual machine scale set that is set to VM (virtual machines) orchestration mode.
 D. Deploy one virtual machine scale set that is set to ScaleSetVM orchestration mode.
Answer: D
Reference:
Question #31
 A. 1
 B. 2
 C. 3
 D. 4
Answer: B
Question #32
HOTSPOT -
You have a pay-as-you-go Azure subscription that contains the virtual machines shown in the
following table.

Hot Area:
Answer:

Budget alerts for Resource Group RG1, which include VM1, but not VM2.VM1 consumes 20
Euro/day. The 50%, 500 Euro limit, will be reached in 25 days, and an email will be sent.
The 70% and 100% alert conditions will not be reached within a month, and they don't trigger email
actions anyway.
Credit alerts: Credit alerts are generated automatically at 90% and at 100% of your Azure credit
balance. Whenever an alert is generated, it's reflected in cost alerts and in the email sent to the
account owners. 90% and 100% will not be reached though.
Reference:
https://docs.microsoft.com/en-us/azure/cost-management-billing/costs/cost-mgt-alerts-monitor-
usage-spending
Question #33
deployment.
 A. Yes
 B. No
Answer: B
Reference:
Question #34

 A. Yes
 B. No
Answer: B

Reference:
Question #35
You have an Azure Active Directory (Azure AD) tenant named adatum.com that contains the users

➨ Users may join devices to Azure AD is set to User1.
➨ Additional local administrators on Azure AD joined devices is set to None.
You deploy Windows 10 to a computer named Computer1. User1 joins Computer1 to adatum.com.
 A. User1 only
 B. User2 only
 C. User1 and User2 only
 D. User1, User2, and User3 only
 E. User1, User2, User3, and User4
Answer: C
Users may join devices to Azure AD - This setting enables you to select the users who can register
their devices as Azure AD joined devices. The default is All.
Additional local administrators on Azure AD joined devices - You can select the users that are
granted local administrator rights on a device. Users added here are added to the Device
Administrators role in Azure AD. Global administrators, here User2, in Azure AD and device owners
are granted local administrator rights by default.
Reference:
Question #36
HOTSPOT -
Hot Area:
Answer:
Box 1: No -
RG2 is read only. ReadOnly means authorized users can read a resource, but they cannot delete or
update the resource.
Box 2: Yes -
Box 3: Yes -
Note:
App Service resources are region-specific and cannot be moved across regions. You must create a
copy of your existing App Service resources in the target region, then move your content over to the
new app. You can then delete the source app and App Service plan.
To make copying your app easier, you can clone an individual App Service app into an App Service
plan in another region.
Reference:
https://docs.microsoft.com/en-us/azure/app-service/manage-move-across-regions
https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/move-
limitations/app-service-move-limitations
Question #37
HOTSPOT -
➨Name: RG1
➨ Region: West US
➨ Tag: ‫ג‬€tag1‫ג‬€: ‫ג‬€value1‫ג‬€
➨ Exclusions: None
➨ Policy definition: Append a tag and its value to resources
➨Assignment name: Policy1
➨Parameters:
➨ Tag name: tag2
➨ Tag value: value2
Name: storage1 -
➨ Location: West US
➨Resource group: RG1
➨Tags: ‫ג‬€tag3‫ג‬€: ‫ג‬€value3‫ג‬€
Hot Area:
Answer:
Box 1: "tag1": "value1" only -

Reference:
Question #38
HOTSPOT -

Hot Area:
Answer:
Box 1: 60 -
Box 2: 12 -
Note: Rate limiting is a suspension of notifications that occurs when too many are sent to a
particular phone number, email address or device. Rate limiting ensures that alerts are manageable
and actionable.
➨SMS: No more than 1 SMS every 5 minutes.
➨ Voice: No more than 1 Voice call every 5 minutes.
➨ Email: No more than 100 emails in an hour.
➨Other actions are not rate limited.

Reference:
Question #39
following table.
 A. VM1 only
 B. VM3 and VMC only
 C. VM1, VM2, VM3, VMA, VMB, and VMC
 D. VM1, VM3, VMA, and VMC only
 E. VM1 and VM3 only
Answer: D
To create a vault to protect virtual machines, the vault must be in the same region as the virtual
machines. If you have virtual machines in several regions, create a
Recovery Services vault in each region.
Reference:
Question #40
 A. the kubectl command

 B. the az aks command
 C. the Set-AzVm cmdlet
 D. the Azure portal
 E. the Set-AzAks cmdlet
Answer: BD
A: The following example uses the kubectl autoscale command to autoscale the number of pods in
the azure-vote-front deployment. If average CPU utilization across all pods exceeds 50% of their
requested usage, the autoscaler increases the pods up to a maximum of 10 instances. A minimum of
3 instances is then defined for the deployment: kubectl autoscale deployment azure-vote-front --
cpu-percent=50 --min=3 --max=10
B: Use the az aks update command to enable and configure the cluster autoscaler on the node pool
for the existing cluster.
Reference:
https://docs.microsoft.com/en-us/azure/aks/tutorial-kubernetes-scale
https://docs.microsoft.com/en-us/azure/aks/cluster-autoscaler
Question #41
➨ An Azure Container Registry instance named Registry1
➨An Azure Kubernetes Service (AKS) cluster named Cluster1
 A. Run the docker push command.

 B. Create an App Service plan.
 C. Run the az acr build command.
 D. Run the az aks create command.
Answer: A
Run the az acr build command to build and push the container image. az acr build \
--file Dockerfile .
Reference:
Question #42

 A. Proximity2 only
 B. Proximity1, Proximity2, and Proximity3
 C. Proximity1 only
 D. Proximity1 and Proximity3 only
Answer: A
Only Proximity2, which also in RG2, is location in West US
Reference:
Question #43
providers.
 A. Yes
 B. No
Answer: B
Question #44
 A. Yes
 B. No
Answer: B
Reference:
Question #45
 A. Yes
 B. No
Answer: A
Reference:
Question #46
 A. Azure HDInsight
 B. Linux Diagnostic Extension (LAD) 3.0
 C. the AzurePerformanceDiagnostics extension
 D. Azure Analysis Services
Answer: B
The basic host metrics are available, but to see more granular and VM-specific metrics, you need to
install the Azure diagnostics extension on the VM. The Azure diagnostics extension allows additional
monitoring and diagnostics data to be retrieved from the VM.
Reference:
Question #47
HOTSPOT -
named VM1.
Hot Area:
Answer:
Box 1:
Rule2 blocks ports 50-60, which includes port 53, the DNS port. Internet users can reach to the Web
server, since it uses port 80.
Box 2:
Note: Rules are processed in priority order, with lower numbers processed before higher numbers,
because lower numbers have higher priority. Once traffic matches a rule, processing stops. As a
result, any rules that exist with lower priorities (higher numbers) that have the same attributes as
rules with higher priorities are not processed.
Reference:
Question #48
You plan to deploy three Azure virtual machines named VM1, VM2, and VM3. The virtual machines
will host a web app named App1.
You need to ensure that at least two virtual machines are available if a single Azure datacenter
becomes unavailable.
 A. all three virtual machines in a single Availability Zone

 B. all virtual machines in a single Availability Set
 C. each virtual machine in a separate Availability Zone
 D. each virtual machine in a separate Availability Set
Answer: C
Use availability zones to protect from datacenter level failures.
Reference:
Question #49
 A. operating system
 B. administrator username
 C. virtual machine size
 D. resource group
Answer: D
➨the Resource Group name and location for the VM
➨the administrator username and password
➨ an unique DNS name for the public IP
Reference:
Question #50
You have an Azure subscription that contains an Azure virtual machine named VM1. VM1 runs a
financial reporting app named App1 that does not support multiple active instances.
You need to create a scheduled runbook to increase the processor performance of VM1 at the end
of each month.
 A. Add the Azure Performance Diagnostics agent to VM1.

 B. Modify the VM size property of VM1.
 C. Add VM1 to a scale set.
 D. Increase the vCPU quota for the subscription.
 E. Add a Desired State Configuration (DSC) extension to VM1.
Answer: B
Reference:
Question #51
 A. Deployment Center in Azure App Service

 B. A Desired State Configuration (DSC) extension
 C. the New-AzConfigurationAssignment cmdlet
 D. a Microsoft Intune device configuration profile
Answer: B
Azure virtual machine extensions are small packages that run post-deployment configuration and
automation on Azure virtual machines.
In the following example, the Azure CLI is used to deploy a custom script extension to an existing
virtual machine, which installs a Nginx webserver. az vm extension set \
--resource-group myResourceGroup \
--vm-name myVM --name customScript \
--publisher Microsoft.Azure.Extensions \
--settings '{"commandToExecute": "apt-get install -y nginx"}
Note:
➨ the Publish-AzVMDscConfiguration cmdlet
➨ Azure Application Insights
Reference:
Question #52
HOTSPOT -
You deploy an Azure Kubernetes Service (AKS) cluster that has the network profile shown in the
following exhibit.
Hot Area:
Answer:
Box 1: 10.244.0.0/16 -
The Pod CIDR.
Note: The --pod-cidr should be a large address space that isn't in use elsewhere in your network
environment. This range includes any on-premises network ranges if you connect, or plan to
connect, your Azure virtual networks using Express Route or a Site-to-Site VPN connection.
This address range must be large enough to accommodate the number of nodes that you expect to
scale up to. You can't change this address range once the cluster is deployed if you need more
addresses for additional nodes.
Box 2: 10.0.0.0/16 -
The --service-cidr is used to assign internal services in the AKS cluster an IP address.
Reference:
https://docs.microsoft.com/en-us/azure/aks/configure-kubenet
Question #53
HOTSPOT -
You have the App Service plan shown in the following exhibit.
The scale-in settings for the App Service plan are configured as shown in the following exhibit.
The scale out rule is configured with the same duration and cool down tile as the scale in rule.
Hot Area:
Answer:
Box 1: 5 -
The maximum 5 will kept as the CPU Usage >= 30.
Box 2: 3 -
In 9 minutes the count will be decreased twice from 5 reaching 3.
Reference:
https://docs.microsoft.com/en-us/azure/azure-monitor/learn/tutorial-autoscale-performance-
schedule
Question #54
You have an Azure virtual machine named VM1 that runs Windows Server 2019. The VM was
deployed using default drive settings.
➨ Create files on drive C.
➨ Create files on drive D.

➨ Modify the screen saver timeout.
➨ Change the desktop background.
 A. the modified screen saver timeout

 B. the new desktop background
 C. the new files on drive D
 D. the new files on drive C
Answer: C
Question #55
exhibit. (Click the Exhibit tab.)
machines.
 A. the memory
 B. the network adapters
 C. the hard drive
 D. the processor
 E. Integration Services
Answer: C
Before you upload a Windows virtual machine (VM) from on-premises to Microsoft Azure, you must
prepare the virtual hard disk (VHD or VHDX). Azure supports only generation 1 VMs that are in the
VHD file format and have a fixed sized disk. The maximum size allowed for the VHD is 1,023 GB. You
can convert a generation 1 VM from the VHDX file system to VHD and from a dynamically expanding
disk to fixed-sized.
Reference:
Question #56
HOTSPOT -
You have an Azure subscription that contains a virtual machine scale set. The scale set contains four
instances that have the following configurations:
➨ Operating system: Windows Server 2016
➨Size: Standard_D1_v2
Hot Area:
Answer:
The Get-AzVmssVM cmdlet gets the model view and instance view of a Virtual Machine Scale Set
(VMSS) virtual machine.
Box 1: 0 -
The enableAutomaticUpdates parameter is set to false. To update existing VMs, you must do a
manual upgrade of each existing VM.
Box 2: 4 -
Enabling automatic OS image upgrades on your scale set helps ease update management by safely
and automatically upgrading the OS disk for all instances in the scale set.
Reference:
upgrade-scale-set https://docs.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-
machine-scale-sets-automatic-upgrade
Question #57
You have an Azure subscription named Subscription1 that is used by several departments at your
company. Subscription1 contains the resources in the following table:
Another administrator deploys a virtual machine named VM1 and an Azure Storage account named
storage2 by using a single Azure Resource Manager template.
 A. VM1
 B. RG1
 C. storage2
 D. container1
Answer: B
1. Go to the resource group for your new resource group. Notice that the portal shows the result of
the last deployment. Select this link.
3. The portal displays a summary of the deployment. The summary includes the status of the
Reference:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-manager-export-
template
Question #58
You have an Azure web app named App1. App1 has the deployment slots shown in the following
table:

You back up App1.
You swap webapp1-test for webapp1-prod and discover that App1 is experiencing performance
issues.
What should you do?
 A. Redeploy App1
 B. Swap the slots
 C. Clone App1
 D. Restore the backup of App1
Answer: B
When you swap deployment slots, Azure swaps the Virtual IP addresses of the source and
destination slots, thereby swapping the URLs of the slots. We can easily revert the deployment by
swapping back.
Reference:
Question #59
HOTSPOT -
You have an Azure subscription named Subscription1. Subscription1 contains two Azure virtual
machines VM1 and VM2. VM1 and VM2 run Windows Server
2016.
To which location can you restore the backup? To answer, select the appropriate options in the
answer area.
Hot Area:
Answer:

Reference:
- Question Set 4
Question #1
HOTSPOT -
You have an Azure subscription that contains a virtual network named VNet1. VNet1 uses an IP
address space of 10.0.0.0/16 and contains the subnets in the following table:

Hot Area:
Answer:
Question #2
machines.
 A. Floating IP (direct server return) to Enabled

 B. Floating IP (direct server return) to Disabled
 C. a health probe
 D. Session persistence to Client IP and Protocol
Answer: D
With Sticky Sessions when a client starts a session on one of your web servers, session stays on that
specific server. To configure An Azure Load-Balancer For
Sticky Sessions set Session persistence to Client IP.
Note:
There are several versions of this question in the exam. The question can have other incorrect
answer options, including the following:
1. Idle Time-out (minutes) to 20
2. Protocol to UDP
Reference:
Question #3
HOTSPOT -
VM1 and VM2 use public IP addresses. From Windows Server 2019 on VM1 and VM2, you allow
inbound Remote Desktop connections.
The subscription contains two network security groups (NSGs) named NSG1 and NSG2. NSG1 uses
only the default rules.
➨ Priority: 100
➨Name: Rule1
➨ Port: 3389
➨ Protocol: TCP
➨Source: Any
➨ Destination: Any
➨ Action: Allow
Hot Area:
Answer:
Question #4
HOTSPOT -
You have two Azure virtual machines that have the network configurations shown in the following
table:

Hot Area:
Answer:
Box 1: Yes -
The inbound security rule for NSG1 allows TCP port 1433 from 10.10.2.0/24 (or Subnet2 where VM2
and VM3 are located) to 10.10.1.0/24 (or Subnet1 where
VM1 is located) while the inbound security rule for NSG2 blocks TCP port 1433 from 10.10.2.5 (or
VM2) to 10.10.1.5 (or VM1). However, the NSG1 rule has a higher priority (or lower value) than the
NSG2 rule.
Box 2: Yes -
No rule explicitly blocks communication from VM1. The default rules, which allow communication,
are thus applied.
Box 3: Yes -
No rule explicitly blocks communication between VM2 and VM3 which are both on Subnet2. The
default rules, which allow communication, are thus applied.
Reference:
Question #5
HOTSPOT -
VM3 has multiple network adapters, including a network adapter named NIC3. IP forwarding is
enabled on NIC3. Routing is enabled on VM3.

Hot Area:
Answer:

➨ Receive network traffic not destined for one of the IP addresses assigned to any of the IP
configurations assigned to the network interface.
➨Send network traffic with a different source IP address than the one assigned to one of a network
The setting must be enabled for every network interface that is attached to the virtual machine that
receives traffic that the virtual machine needs to forward. A virtual machine can forward traffic
whether it has multiple network interfaces or a single network interface attached to it.
Box 1: Yes -
The routing table allows connections from VM3 to VM1 and VM2. And as IP forwarding is enabled on
VM3, VM3 can connect to VM1.
Box 2: No -
Box 3: Yes -
The routing table allows connections from VM1 and VM2 to VM3. IP forwarding on VM3 allows VM1
to connect to VM2 via VM3.
Reference:
Question #6
➨ A web app named webapp1
➨ A virtual network named VNET1
 A. an Azure Application Gateway

 B. an Azure Active Directory (Azure AD) Application Proxy
 C. an Azure Virtual Network Gateway
Answer: C
A Site-to-Site VPN gateway connection can be used to connect your on-premises network to an
Azure virtual network over an IPsec/IKE (IKEv1 or IKEv2) VPN tunnel.
This type of connection requires a VPN device, a VPN gateway, located on-premises that has an
externally facing public IP address assigned to it.
Incorrect Answers:
B: Application Proxy is a feature of Azure AD that enables users to access on-premises web
applications from a remote client.
Reference:
manager-portal
Question #7
 A. the Publish-AzVMDscConfiguration cmdlet

 B. Azure Application Insights
 C. Azure Custom Script Extension
 D. the New-AzConfigurationAssignement cmdlet
Answer: C
Note:
➨Deployment Center in Azure App Service
➨ a Microsoft Intune device configuration profile
Reference:
Question #8
HOTSPOT -

➨Ensure that communication between the web servers and the business logic tier spreads equally
across the virtual machines.
➨Protect the web servers from SQL injection attacks.
Which Azure resource should you recommend for each requirement? To answer, select the
Hot Area:
Answer:

Azure Internal Load Balancer (ILB) provides network load balancing between virtual machines that
reside inside a cloud service or a virtual network with a regional scope.
Azure Web Application Firewall (WAF) on Azure Application Gateway provides centralized protection
of your web applications from common exploits and vulnerabilities. Web applications are
increasingly targeted by malicious attacks that exploit commonly known vulnerabilities.
Reference:
Question #9
Your company has three offices. The offices are located in Miami, Los Angeles, and New York. Each
office contains datacenter.
You have an Azure subscription that contains resources in the East US and West US Azure regions.
Each region contains a virtual network. The virtual networks are peered.
You need to connect the datacenters to the subscription. The solution must minimize network
latency between the datacenters.
 A. three Azure Application Gateways and one On-premises data gateway

 B. three virtual hubs and one virtual WAN
 C. three virtual WANs and one virtual hub
 D. three On-premises data gateways and one Azure Application Gateway
Answer: B
Reference:
Question #10
HOTSPOT -
What is the minimum number of network interfaces and network security groups that you require?
Hot Area:
Answer:
Box 1: 5 -
Box 2: 1 -
You can associate zero, or one, network security group to each virtual network subnet and network
interface in a virtual machine. The same network security group can be associated to as many
subnets and network interfaces as you choose.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface-
addresses
Question #11
HOTSPOT -
You have Azure virtual machines that run Windows Server 2019 and are configured as shown in the
following table.
You create a private Azure DNS zone named adatum.com. You configure the adatum.com zone to
allow auto registration from VNET1.
Which A records will be added to the adatum.com zone for each virtual machine? To answer, select
Hot Area:
Answer:
The virtual machines are registered (added) to the private zone as A records pointing to their private
IP addresses.
Reference:
https://docs.microsoft.com/en-us/azure/dns/private-dns-overview https://docs.microsoft.com/en-
us/azure/dns/private-dns-scenarios
Question #12
HOTSPOT -
using a site-to-site VPN. VNet1 contains one subnet named
Sunet1.
Subnet1 is associated to a network security group (NSG) named NSG1. Subnet1 contains a basic
internal load balancer named ILB1. ILB1 has three Azure virtual machines in the backend pool.
Hot Area:
Answer:

Box 2: ILB1 -
Reference:
Question #13
 A. VNet2 andVNet3 only

 B. VNet2 only
 C. VNet3 and VNet4 only
 D. VNet2, VNet3, and VNet4
Answer: C
Incorrect Answers:
A, B, C: The address space for VNet2 overlaps with VNet1. We therefore cannot establish a peering
between VNet2 and VNet1.
Reference:
Question #14
You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains four
subnets named Gateway, Perimeter, NVA, and Production.
The NVA subnet contains two network virtual appliances (NVAs) that will perform network traffic
inspection between the Perimeter subnet and the Production subnet.
requirements:
➨ The NVAs must run in an active-active configuration that uses automatic failover.
➨ The load balancer must load balance traffic to two services on the Production subnet. The
services have different IP addresses.
 A. Deploy a basic load balancer

 B. Deploy a standard load balancer
 C. Add two load balancing rules that have HA Ports and Floating IP enabled
 D. Add two load balancing rules that have HA Ports enabled and Floating IP disabled
 E. Add a frontend IP configuration, a backend pool, and a health probe
 F. Add a frontend IP configuration, two backend pools, and a health probe
Answer: BDE
Incorrect Answers:
Reference:
Question #15
named VNet1 and VNet2. VNet1 contains a VPN gateway named
VPNGW1 that uses static routing. There is a site-to-site VPN connection between your on-premises
network and VNet1.
On a computer named Client1 that runs Windows 10, you configure a point-to-site VPN connection
to VNet1.
You configure virtual network peering between VNet1 and VNet2. You verify that you can connect to
VNet2 from the on-premises network. Client1 is unable to connect to VNet2.
What should you do?
 A. Download and re-install the VPN client configuration package on Client1.

 B. Select Allow gateway transit on VNet1.
 C. Select Allow gateway transit on VNet2.
 D. Enable BGP on VPNGW1
Answer: A
Reference:
Question #16
HOTSPOT -
You have an Azure subscription. The subscription contains virtual machines that run Windows Server
2016 and are configured as shown in the following table.
contoso.com.
Hot Area:
Answer:
Reference:
and-role-instances https://docs.microsoft.com/en-us/azure/dns/private-dns-autoregistration
Question #17
 A. the subnets on VNet1 only

 B. the subnets on VNet2 and VNet3 only
 C. the subnets on VNet2 only
 D. the subnets on VNet3 only
 E. the subnets on VNet1, VNet2, and VNet3
Answer: D
All Azure resources are created in an Azure region and subscription. A resource can only be created
in a virtual network that exists in the same region and subscription as the resource.
Reference:
Question #18
DRAG DROP -
You have an Azure subscription that contains two virtual networks named VNet1 and VNet2. Virtual
machines connect to the virtual networks.
The virtual networks have the address spaces and the subnets configured as shown in the following
table.
You need to add the address space of 10.33.0.0/16 to VNet1. The solution must ensure that the
hosts on VNet1 and VNet2 can communicate.
Select and Place:
Answer:

You can't add address ranges to, or delete address ranges from a virtual network's address space
once a virtual network is peered with another virtual network.
To add or remove address ranges, delete the peering, add or remove the address ranges, then re-
create the peering.

Reference:
Question #19
HOTSPOT -
RG2 contains a public IP address named IP2 that is in the East US location. IP2 is not assigned to a
virtual machine.
Hot Area:
Answer:
Box 1: Yes -
You can move storage -
Box 2: No -
Box 3: No -
Reference:
resources https://docs.microsoft.com/en-us/azure/virtual-network/move-across-regions-publicip-
powershell
Question #20
You have a virtual network named VNET1 and an Azure virtual machine named VM1 that hosts a
MySQL database. VM1 connects to VNET1.
What should you do?
 A. Deploy an internal load balancer

 B. Peer VNET1 to another virtual network
 C. Connect webapp1 to VNET1
 D. Deploy an Azure Application Gateway
Answer: C
Question #21

 A. Connect to VM1.
 B. Start VM1.
 C. Capture a snapshot of VM1.
 D. Configure a DNS name for VM1.
Answer: B
The DSC extension for Windows requires that the target virtual machine is able to communicate with
Azure.
Reference:
Question #22
machines.
 A. Floating IP (direct server return) to Disabled

 B. Session persistence to None
 C. Protocol to UDP
 D. Session persistence to Client IP
Answer: D
With Sticky Sessions when a client starts a session on one of your web servers, session stays on that
specific server. To configure An Azure Load-Balancer For
Sticky Sessions set Session persistence to Client IP or to Client IP and protocol.
Note:
➨ Client IP and protocol specifies that successive requests from the same client IP address and
protocol combination will be handled by the same virtual machine.
➨ Client IP specifies that successive requests from the same client IP address will be handled by the
same virtual machine.
Reference:
Question #23
➨ A virtual network that has a subnet named Subnet1
➨ Two network security groups (NSGs) named NSG-VM1 and NSG-Subnet1
➨ A virtual machine named VM1 that has the required Windows Server configurations to allow
➨ Priority: 100
➨ Source: Any
➨ Source port range: *
➨ Destination: *
➨ Destination port range: 3389
➨ Protocol: UDP
➨ Action: Allow
VM1 has a public IP address and is connected to Subnet1. NSG-VM1 is associated to the network
interface of VM1. NSG-Subnet1 is associated to Subnet1.
Solution: You add an inbound security rule to NSG-Subnet1 that allows connections from the Any
source to the *destination for port range 3389 and uses the TCP protocol. You remove NSG-VM1
from the network interface of VM1.

 A. Yes
 B. No
Answer: B
The default port for RDP is TCP port 3389. A rule to permit RDP traffic must be created automatically
when you create your VM.
default.
Reference:
connection
Question #24
➨ A virtual network that has a subnet named Subnet1
➨ Priority: 100
➨ Source: Any
➨ Destination: *
Destination port range: 3389 -
➨ Protocol: UDP
➨ Action: Allow
Solution: You add an inbound security rule to NSG-Subnet1 that allows connections from the
internet source to the VirtualNetwork destination for port range 3389 and uses the UDP protocol.
 A. Yes
 B. No
Answer: B
default.
Reference:
connection
Question #25
➨A virtual network that has a subnet named Subnet1
➨ Priority: 100
➨ Source: Any
➨Destination: *
➨ Destination port range: 3389
➨ Protocol: UDP
➨ Action: Allow
Solution: You add an inbound security rule to NSG-Subnet1 and NSG-VM1 that allows connections
from the internet source to the VirtualNetwork destination for port range 3389 and uses the TCP
protocol.
 A. Yes
 B. No
Answer: A
default.
Reference:
connection
Question #26
HOTSPOT -
Hot Area:
Answer:
Box 1: add an address space -

Your IaaS virtual machines (VMs) and PaaS role instances in a virtual network automatically receive a
private IP address from a range that you specify, based on the address space of the subnet they are
connected to. We need to add the 192.168.1.0/24 address space.
Box 2: add a network interface -

Reference:
https://docs.microsoft.com/en-us/office365/enterprise/designing-networking-for-microsoft-azure-
iaas
Question #27
You have an Azure subscription that contains a virtual network named VNET1. VNET1 contains the
subnets shown in the following table.

➨ Allow web requests from the internet to VM3, VM4, VM5, and VM6.
➨Allow all connections between VM1 and VM2.
➨ Allow Remote Desktop connections to VM1.
➨ Prevent all other network traffic to VNET1.
 A. 1
 B. 3
 C. 4
 D. 12
Answer: A
Note: A network security group (NSG) contains a list of security rules that allow or deny network
traffic to resources connected to Azure Virtual Networks (VNet).
NSGs can be associated to subnets, individual VMs (classic), or individual network interfaces (NIC)
attached to VMs (Resource Manager).
Reference:
Question #28
The Not allowed resource types Azure policy is assigned to RG1 and uses the following parameters:
 A. Remove Microsoft.Compute/virtualMachines from the policy.

 B. Create an Azure Resource Manager template
 C. Add a subnet to VNET1.
 D. Remove Microsoft.Network/virtualNetworks from the policy.
Answer: A
The Not allowed resource types Azure policy prohibits the deployment of specified resource types.
You specify an array of the resource types to block.
Reference:
Question #29
The company also has two on-premises servers named Server1 and Server2 that run Windows
Server 2016. Server1 is configured as a DNS server that has a primary DNS zone named adatum.com.
Adatum.com contains 1,000 DNS records.
➨The DNS Manager console
➨ Azure PowerShell
➨Azure CLI 2.0
You need to move the adatum.com zone to an Azure DNS zone in Subscription1. The solution must
minimize administrative effort.
 A. Azure CLI
 B. Azure PowerShell
 C. the Azure portal
 D. the DNS Manager console
Answer: A
Open an elevated PowerShell window (Administrative mode) and run following command install-
script PrivateDnsMigrationScript
Step 2: Running the script -

PrivateDnsMigrationScript.ps1 -
Reference:
Question #30
You have a public load balancer that balances ports 80 and 443 across three virtual machines.
 A. an inbound NAT rule

 B. a new public load balancer for VM3
 C. a frontend IP configuration
 D. a load balancing rule
Answer: A
Reference:
https://docs.microsoft.com/en-us/azure/load-balancer/tutorial-load-balancer-port-forwarding-
portal https://pixelrobots.co.uk/2017/08/azure-load-balancer-for-rds/
Question #31
HOTSPOT -
You have an Azure subscription named Subscription1 that contains the virtual networks in the
following table.
➨Name: LB1
➨SKU: Basic
➨ Type: Internal
➨ Subnet: Subnet12
➨ Virtual network: VNET1
Hot Area:
Answer:
Reference:
Question #32
HOTSPOT -
You have an Azure virtual machine that runs Windows Server 2019 and has the following
configurations:
➨ Name: VM1
➨ Location: West US
➨ Connected to: VNET1
➨ Private IP address: 10.1.0.4
➨Public IP addresses: 52.186.85.63
➨ DNS suffix in Windows Server: Adatum.com
You need to identify which DNS zones you can link to VNET1 and the DNS zones to which VM1 can
automatically register.
Hot Area:
Answer:
Reference:
Question #33
DRAG DROP -
In Azure, you have an Azure virtual network named VNet1 that uses an address space of 10.0.0.0/16
VNet1 contains a subnet named Subnet1 that uses an address space of 10.0.0.0/24.
Which four actions should you perform in sequence? To answer, move the appropriate actions from
the list of actions to the answer area and arrange them in the correct order.
NOTE: More than one order of answer choice is correct. You will receive credit for any of the correct
orders you select.
Select and Place:
Answer:
Question #34
You need to prevent users of VM1 and VM2 from accessing websites on the Internet over TCP port
80.
What should you do?
 A. Disassociate the NSG from a network interface

 B. Change the Port_80 inbound security rule.
 C. Associate the NSG to Subnet1.
 D. Change the DenyWebSites outbound security rule.
Answer: C
The NSG has the appropriate rule to block users from accessing the Internet. We just need to
Reference:
Question #35
You have two subscriptions named Subscription1 and Subscription2. Each subscription is associated
to a different Azure AD tenant.

 A. Move VM1 to Subscription2.

 B. Move VNet1 to Subscription2.
 C. Modify the IP address space of VNet2.
 D. Provision virtual network gateways.
Answer: D
The virtual networks can be in the same or different regions, and from the same or different
subscriptions. When connecting VNets from different subscriptions, the subscriptions do not need to
be associated with the same Active Directory tenant.
Configuring a VNet-to-VNet connection is a good way to easily connect VNets. Connecting a virtual
network to another virtual network using the VNet-to-VNet connection type (VNet2VNet) is similar
to creating a Site-to-Site IPsec connection to an on-premises location. Both connectivity types use a
VPN gateway to provide a secure tunnel using IPsec/IKE, and both function the same way when
communicating.
The local network gateway for each VNet treats the other VNet as a local site. This lets you specify
additional address space for the local network gateway in order to route traffic.
Reference:
https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-vnet-vnet-resource-
manager-portal
Question #36
You plan to create an Azure virtual machine named VM1 that will be configured as shown in the
following exhibit.

 A. Use managed disks

 B. OS disk type
 C. Availability options
 D. Size
 E. Image
Answer: AC
A: Your VMs should use managed disks if you want to move them to an Availability Zone by using
Site Recovery.
B: When you create a VM for an Availability Zone, Under Settings > High availability, select one of
the numbered zones from the Availability zone dropdown.
Reference:
https://docs.microsoft.com/en-us/azure/site-recovery/move-azure-vms-avset-azone
https://docs.microsoft.com/en-us/azure/virtual-machines/windows/create-portal-availability-zone
Question #37
HOTSPOT -

Which resource group and location should you use to deploy VM1? To answer, select the
Hot Area:
Answer:
Box 1: RG1, RG2, or RG3 -
The resource group stores metadata about the resources. When you specify a location for the
resource group, you're specifying where that metadata is stored.
Box 2: West US only -

ScaleSetVM ‫ג‬€" Virtual machine instances added to the scale set are based on the scale set
configuration model. The virtual machine instance lifecycle - creation, update, deletion - is managed
by the scale set.
VM (virtual machines) ‫ג‬€" Virtual machines created outside of the scale set can be explicitly added to
the scaleset.
Reference:
Question #38
HOTSPOT -
You have an Azure subscription that contains three virtual networks named VNET1, VNET2, and
VNET3.
How can packets be routed between the virtual networks? To answer, select the appropriate options
in the answer area.
Hot Area:
Answer:
Box 1. VNET2 and VNET3 -
Box 2: VNET1 -
Reference:
Question #39
You have a computer named Computer1 that has a point-to-site VPN connection to an Azure virtual
network named VNet1. The point-to-site connection uses a self-signed certificate.
From Azure, you download and install the VPN client configuration package on a computer named
Computer2.
 A. Yes
 B. No
Answer: B
Note:
installed. You generate a client certificate from the self-signed root certificate, and then export and
install the client certificate. If the client certificate is not installed, authentication fails.
Reference:
Question #40
Computer2.
 A. Yes
 B. No
Answer: B
Reference:
Question #41
You have an Azure subscription that contains 10 virtual networks. The virtual networks are hosted in
separate resource groups.
You need to ensure that when an NSG is created, it automatically blocks TCP port 8080 between the
virtual networks.
 A. Yes
 B. No
Answer: B
Question #42
named VM1.
Internet.
fails.
 A. Change the priority of the RDP rule

 B. Attach a network interface
 C. Delete the DenyAllInBound rule
 D. Start VM1
Answer: D
Incorrect Answers:
A: Rules are processed in priority order, with lower numbers processed before higher numbers,
because lower numbers have higher priority. Once traffic matches a rule, processing stops. RDP
already has the lowest number and thus the highest priority.
Reference:
Question #43

You need to ensure that all the virtual machines can resolve DNS names by using the DNS service on
VM1.
What should you do?
 A. Configure a conditional forwarder on VM1

 B. Add service endpoints on VNET1
 C. Add service endpoints on VNET2 and VNET3
 D. Configure peering between VNET1, VNET2, and VNET3
Answer: D
Virtual network peering enables you to seamlessly connect networks in Azure Virtual Network. The
virtual networks appear as one for connectivity purposes. The traffic between virtual machines uses
the Microsoft backbone infrastructure.
Incorrect Answers:
B, C: Virtual Network (VNet) service endpoint provides secure and direct connectivity to Azure
services over an optimized route over the Azure backbone network.
Endpoints allow you to secure your critical Azure service resources to only your virtual networks.
Service Endpoints enables private IP addresses in the VNet to reach the endpoint of an Azure service
without needing a public IP address on the VNet.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-
overview https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-
overview
Question #44
HOTSPOT -
table.
You add inbound security rules to a network security group (NSG) named NSG1 as shown in the
following table.


Hot Area:
Answer:
Box 1: No -
Box 2: Yes -
Box 3: No -
Reference:
Question #45
You have the Azure virtual network named VNet1 that contains a subnet named Subnet1. Subnet1
contains three Azure virtual machines. Each virtual machine has a public IP address.
The virtual machines host several applications that are accessible over port 443 to users on the
Internet.
You discover that the virtual machines can be accessed by using the Remote Desktop Protocol (RDP)
from the Internet and from the on-premises network.
You need to prevent RDP access to the virtual machines from the Internet, unless the RDP
connection is established from the on-premises network. The solution must ensure that all the
applications can still be accessed by the Internet users.
What should you do?
 A. Modify the address space of the local network gateway

 B. Create a deny rule in a network security group (NSG) that is linked to Subnet1
 C. Remove the public IP addresses from the virtual machines
 D. Modify the address space of Subnet1
Answer: B
You can use a site-to-site VPN to connect your on-premises network to an Azure virtual network.
Users on your on-premises network connect by using the RDP or
SSH protocol over the site-to-site VPN connection. You don't have to allow direct RDP or SSH access
over the internet.
Reference:
Question #46

What should you do?
 A. Associate NIC1 to ASG1

 B. Modify the properties of ASG1
 C. Modify the properties of NSG1
Answer: A
References:
https://docs.microsoft.com/en-us/azure/virtual-network/security-overview#application-security-
groups
Question #47
You have an Azure subscription named Subscription1 that contains an Azure virtual network named
VNet1. VNet1 connects to your on-premises network by using
Azure ExpressRoute.
must minimize cost.
 A. Create a connection
 B. Create a local site VPN gateway
 C. Create a VPN gateway that uses the VpnGw1 SKU
 D. Create a gateway subnet
 E. Create a VPN gateway that uses the Basic SKU
Answer: ABC
Reference:
manager-portal
Question #48
HOTSPOT -
Hot Area:
Answer:
Box 1: vNET6 only -

Box 2: delete peering1 -

Peering to Vnet1 is Enabled but disconnected. We need to update or re-create the remote peering
to get it back to Initiated state.
Reference:
Question #49
HOTSPOT -
You install the Web Server server role (IIS) on VM1 and VM2, and then add VM1 and VM2 to LB1.
LB1 is configured as shown in the LB1 exhibit. (Click the LB1 tab.)
Rule1 is configured as shown in the Rule1 exhibit. (Click the Rule1 tab.)
Hot Area:
Answer:
Box 1: Yes -
A Basic Load Balancer supports virtual machines in a single availability set or virtual machine scale
set.
Box 2: Yes -
When using load-balancing rules with Azure Load Balancer, you need to specify health probes to
allow Load Balancer to detect the backend endpoint status. The configuration of the health probe
and probe responses determine which backend pool instances will receive new flows. You can use
health probes to detect the failure of an application on a backend endpoint. You can also generate a
custom response to a health probe and use the health probe for flow control to manage load or
planned downtime. When a health probe fails, Load Balancer will stop sending new flows to the
respective unhealthy instance. Outbound connectivity is not impacted, only inbound connectivity is
impacted.
Box 3: No -
Reference:
https://docs.microsoft.com/en-us/azure/load-balancer/skus
https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-custom-probe-overview
Question #50
HOTSPOT -
You have an Azure virtual machine named VM1 that connects to a virtual network named VNet1.
VM1 has the following configurations:
➨Subnet: 10.0.0.0/24
➨Availability set: AVSet
➨ Network security group (NSG): None
➨ Private IP address: 10.0.0.4 (dynamic)
➨Public IP address: 40.90.219.6 (dynamic)
Which changes should you apply to VM1 as you configure slb1? To answer, select the appropriate
Hot Area:
Answer:
Change the private IP address of VM1 to static

Box 1: Remove the public IP address from VM1
Note: A public load balancer can provide outbound connections for virtual machines (VMs) inside
your virtual network. These connections are accomplished by translating their private IP addresses
to public IP addresses. Public Load Balancers are used to load balance internet traffic to your VMs.
Box 2: Create and configure an NSG
NSGs are used to explicitly permit allowed traffic. If you do not have an NSG on a subnet or NIC of
your virtual machine resource, traffic is not allowed to reach this resource.
Reference:
https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-overview
Question #51

 A. East US and North Europe only

 B. East US only
 C. East US, West Europe, and North Europe
 D. East US and West Europe only
Answer: B
Before creating a network interface, you must have an existing virtual network in the same location
and subscription you create a network interface in.
Reference:
Question #52
You have Azure virtual machines that run Windows Server 2019 and are configured as shown in the
following table.
contoso.com.
For controso.com, you create a virtual network link named link1 as shown in the exhibit. (Click the
Exhibit tab.)
You discover that VM1 can resolve names in contoso.com but cannot resolve names in adatum.com.
VM1 can resolve other hosts on the Internet.
What should you do?
 A. Update the DNS suffix on VM1 to be adatum.com

 B. Configure the name servers for adatum.com at the domain registrar
 C. Create an SRV record in the contoso.com zone
 D. Modify the Access control (IAM) settings for link1
Answer: B
If you use Azure Provided DNS then appropriate DNS suffix will be automatically applied to your
virtual machines. For all other options you must either use Fully
Qualified Domain Names (FQDN) or manually apply appropriate DNS suffix to your virtual machines.
Reference:
and-role-instances
Question #53
HOTSPOT -
➨ Task1: Identify a security rule that prevents a network packet from reaching an Azure virtual
machine.
➨Task2: Validate outbound connectivity from an Azure virtual machine to an external host.
Which feature should you use for each task? To answer, select the appropriate options in the answer
area.
Hot Area:
Answer:
Box 1: IP flow verify -

At some point, a VM may become unable to communicate with other resources, because of a
security rule. The IP flow verify capability enables you to specify a source and destination IPv4
address, port, protocol (TCP or UDP), and traffic direction (inbound or outbound). IP flow verify then
tests the communication and informs you if the connection succeeds or fails. If the connection fails,
IP flow verify tells you which.
Box 2: Connection troubleshoot -

Diagnose outbound connections from a VM: The connection troubleshoot capability enables you to
test a connection between a VM and another VM, an FQDN, a
URI, or an IPv4 address. The test returns similar information returned when using the connection
monitor capability, but tests the connection at a point in time, rather than monitoring it over time,
as connection monitor does. Learn more about how to troubleshoot connections using connection-
troubleshoot.
Reference:
Question #54
HOTSPOT -
table.
You configure the network interfaces of the virtual machines to use the settings shown in the
following table.
From the settings of VNET1 you configure the DNS servers shown in the following exhibit.
The virtual machines can successfully connect to the DNS server that has an IP address of
192.168.10.15 and the DNS server that has an IP address of
193.77.134.10.
Hot Area:
Answer:
Box 1: Yes -
You can specify DNS server IP addresses in the VNet settings. The setting is applied as the default
DNS server(s) for all VMs in the VNet.
Box 2: No -
Box 3: Yes -
Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-faq#name-resolution-dns
Question #55
HOTSPOT -
You need to identify which resources you can move from RG1 to RG2, and which resources you can
move from RG2 to RG1.
Which resources should you identify? To answer, select the appropriate options in the answer area.
Hot Area:
Answer:
Box 1: IP1, Storage1 -

IP addresses and storage accounts can be moved.
Virtual networks cannot be moved.
There is no lock on RG1.
Box 2: None -
There is a delete lock on RG2.
Note: When you apply a lock at a parent scope, all resources within that scope inherit the same lock.
Even resources you add later inherit the lock from the parent.
The most restrictive lock in the inheritance takes precedence.
CanNotDelete means authorized users can still read and modify a resource, but they can't delete the
resource.
ReadOnly means authorized users can read a resource, but they can't delete or update the resource.
Applying this lock is similar to restricting all authorized users to the permissions granted by the
Reader role.
Reference:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources
resources
Question #56

➨ Name: LB1
➨Type: Internal
➨SKU: Standard
➨Virtual network: VNET1
Solution: You create a Basic SKU public IP address, associate the address to the network interface of
VM1, and then start VM1.
 A. Yes
 B. No
Answer: B
➨ Standard load balancer only
Reference:
Question #57

➨Name: LB1
➨ Type: Internal
➨SKU: Standard
Solution: You create a Standard SKU public IP address, associate the address to the network
interface of VM1, and then stop VM2.
 A. Yes
 B. No
Answer: B
Reference:
Question #58

➨ Name: LB1
➨ Type: Internal
➨ SKU: Standard
Solution: You create two Standard public IP addresses and associate a Standard SKU public IP
address to the network interface of each virtual machine.
 A. Yes
 B. No
Answer: A
Reference:
Question #59
Computer2.
Solution: You export the client certificate from Computer1 and install the certificate on Computer2.
 A. Yes
 B. No
Answer: A
installed. You generate a client certificate from the self-signed root certificate, and then export and
install the client certificate. If the client certificate is not installed, authentication fails.
Reference:
Question #60
You deploy a web server on VM1, and then create a secure website that is accessible by using the
HTTPS protocol. VM1 is used as a web server only.
You need to ensure that users can connect to the website from the Internet.
What should you do?
 A. Modify the protocol of Rule4

 B. Delete Rule1
 C. For Rule5, change the Action to Allow and change the priority to 401
 D. Create a new inbound rule that allows TCP protocol 443 and configure the rule to have a priority of
501.
Answer: C
HTTPS uses port 443.
Rule2, with priority 500, denies HTTPS traffic.
Rule5, with priority changed from 2000 to 401, would allow HTTPS traffic.
Note: Priority is a number between 100 and 4096. Rules are processed in priority order, with lower
numbers processed before higher numbers, because lower numbers have higher priority. Once
traffic matches a rule, processing stops. As a result, any rules that exist with lower priorities (higher
numbers) that have the same attributes as rules with higher priorities are not processed.
Note:
There are several versions of this question in the exam. The question has two possible correct
answers:
1. Change the priority of Rule3 to 450.
2. For Rule5, change the Action to Allow and change the priority to 401.
➨ Modify the action of Rule1.
➨ Change the priority of Rule6 to 100.
➨For Rule4, change the protocol from UDP to Any.
Reference:
Question #61
virtual networks.
 A. Yes
 B. No
Answer: B
Resource policy definition used by Azure Policy enables you to establish conventions for resources in
your organization by describing when the policy is enforced and what effect to take. By defining
conventions, you can control costs and more easily manage your resources.
Reference:
Question #62
HOTSPOT -
You manage two Azure subscriptions named Subscription1 and Subscription2.
Subscription1 has following virtual networks:
The virtual networks contain the following subnets:
Subscription2 contains the following virtual network:

➨ Name: VNETA
➨ Address space: 10.10.128.0/17
➨ Location: Canada Central
VNETA contains the following subnets:
Hot Area:
Answer:
Box 1: Yes -
With VNet-to-VNet you can connect Virtual Networks in Azure across different regions.
Box 2: Yes -
Azure supports the following types of peering:
✑ Virtual network peering: Connect virtual networks within the same Azure region.
✑ Global virtual network peering: Connecting virtual networks across Azure regions.
Box 3: No -
Reference:
https://azure.microsoft.com/en-us/blog/vnet-to-vnet-connecting-virtual-networks-in-azure-across-
different-regions/ https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-
manage-peering#requirements-and-constraints
Question #63
You have an app named App1 that is installed on two Azure virtual machines named VM1 and VM2.
Connections to App1 are managed by using an Azure Load
Balancer.
You need to ensure that connections to App1 can be established successfully from 131.107.100.50
over TCP port 443.
Solution: You create an inbound security rule that denies all traffic from the 131.107.100.50 source
and has a cost of 64999.
 A. Yes
 B. No
Answer: B
Reference:
Question #64
Balancer.
over TCP port 443.
Solution: You delete the BlockAllOther443 inbound security rule.
 A. Yes
 B. No
Answer: A
Reference:
Question #65
Balancer.
over TCP port 443.
Solution: You modify the priority of the Allow_131.107.100.50 inbound security rule.
 A. Yes
 B. No
Answer: B
The rule currently has the highest priority.
Reference:
Question #66
virtual networks.
 A. Yes
 B. No
Answer: B
Reference:
Question #67
You plan to deploy an Azure Kubernetes Service (AKS) cluster to support an app named App1. On-
premises clients connect to App1 by using the IP address of the pod.
For the AKS cluster, you need to choose a network type that will support App1.
What should you choose?
 A. kubenet
 B. Azure Container Networking Interface (CNI)
 C. Hybrid Connection endpoints
 D. Azure Private Link
Answer: B
With Azure CNI, every pod gets an IP address from the subnet and can be accessed directly. These IP
addresses must be unique across your network space.
Incorrect Answers:
A: The kubenet networking option is the default configuration for AKS cluster creation. With
kubenet, nodes get an IP address from the Azure virtual network subnet. Pods receive an IP address
from a logically different address space to the Azure virtual network subnet of the nodes. Network
address translation (NAT) is then configured so that the pods can reach resources on the Azure
virtual network.
C, D: AKS only supports Kubenet networking and Azure Container Networking Interface (CNI)
networking
Reference:
https://docs.microsoft.com/en-us/azure/aks/concepts-network
Question #68

➨Name: LB1
➨ Type: Internal
➨SKU: Standard
Solution: You disassociate the public IP address from the network interface of VM2.
 A. Yes
 B. No
Answer: A
Question #69
virtual networks.
subscription.
 A. Yes
 B. No
Answer: A
Reference:
Question #70
 A. IP flow verify
 B. Connection troubleshoot
 C. Connection monitor
 D. NSG flow logs
Answer: C
The connection monitor capability monitors communication at a regular interval and informs you of
reachability, latency, and network topology changes between the VM and the endpoint
Incorrect Answers:
A: The IP flow verify capability enables you to specify a source and destination IPv4 address, port,
protocol (TCP or UDP), and traffic direction (inbound or outbound). IP flow verify then tests the
communication and informs you if the connection succeeds or fails. If the connection fails, IP flow
verify tells you which security rule allowed or denied the communication, so that you can resolve the
problem.
B: The connection troubleshoot capability enables you to test a connection between a VM and
another VM, an FQDN, a URI, or an IPv4 address. The test returns similar information returned when
using the connection monitor capability, but tests the connection at a point in time, rather than
monitoring it over time, as connection monitor does.
D: The NSG flow log capability allows you to log the source and destination IP address, port,
protocol, and whether traffic was allowed or denied by an NSG.
Reference:
Question #71
HOTSPOT -
You have an Azure subscription that contains the public load balancers shown in the following table.
You plan to create six virtual machines and to load balance requests to the virtual machines. Each
load balancer will load balance three virtual machines.
You need to create the virtual machines for the planned solution.
Hot Area:
Answer:
Box 1: be created in the same availability set or virtual machine scale set.
The Basic tier is quite restrictive. A load balancer is restricted to a single availability set, virtual
machine scale set, or a single machine.
Box 2: be connected to the same virtual network
The Standard tier can span any virtual machine in a single virtual network, including blends of scale
sets, availability sets, and machines.
Reference:
https://www.petri.com/comparing-basic-standard-azure-load-balancers
Question #72
HOTSPOT -
You have an on-premises data center and an Azure subscription. The data center contains two VPN
devices. The subscription contains an Azure virtual network named VNet1. VNet1 contains a gateway
subnet.
You need to create a site-to-site VPN. The solution must ensure that if a single instance of an Azure
VPN gateway fails, or a single on-premises VPN device fails, the failure will not cause an interruption
that is longer than two minutes.
What is the minimum number of public IP addresses, virtual network gateways, and local network
gateways required in Azure? To answer, select the appropriate options in the answer area.
Hot Area:
Answer:
Box 1: 4 -
Two public IP addresses in the on-premises data center, and two public IP addresses in the VNET.
The most reliable option is to combine the active-active gateways on both your network and Azure,
as shown in the diagram below.
Box 2: 2 -
Every Azure VPN gateway consists of two instances in an active-standby configuration. For any
planned maintenance or unplanned disruption that happens to the active instance, the standby
instance would take over (failover) automatically, and resume the S2S VPN or VNet-to-VNet
connections.
Box 3: 2 -
Reference:
https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-highlyavailable
Question #73
You have an Azure subscription that contains two virtual machines as shown in the following table.
You perform a reverse DNS lookup for 10.0.0.4 from VM2.

Which FQDN will be returned?
 A. vm1.core.windows.net
 B. vm1.azure.com
 C. vm1.westeurope.cloudapp.azure.com
 D. vm1.internal.cloudapp.net
Answer: D
Question #74
Balancer.
over TCP port 443.
Solution: You create an inbound security rule that allows any traffic from the AzureLoadBalancer
source and has a cost of 150.
 A. Yes
 B. No
Answer: B
Reference:
Question #75
You have an Azure subscription that contains a policy-based virtual network gateway named GW1
and a virtual network named VNet1.
You need to ensure that you can configure a point-to-site connection from an on-premises computer
to VNet1.
 A. Add a service endpoint to VNet1

 B. Reset GW1
 C. Create a route-based virtual network gateway
 D. Add a connection to GW1
 E. Delete GW1
 F. Add a public IP address space to VNet1
Answer: CE
Route-based VPN devices use any-to-any (wildcard) traffic selectors, and let routing/forwarding
tables direct traffic to different IPsec tunnels. It is typically built on router platforms where each
IPsec tunnel is modeled as a network interface or VTI (virtual tunnel interface).
E: Policy-based VPN devices use the combinations of prefixes from both networks to define how
traffic is encrypted/decrypted through IPsec tunnels. It is typically built on firewall devices that
perform packet filtering. IPsec tunnel encryption and decryption are added to the packet filtering
and processing engine.
Incorrect Answers:
Reference:
https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-connect-multiple-policybased-
rm-ps
Question #76
HOTSPOT -
In Azure, you create a private DNS zone named adatum.com. You set the registration virtual network
to VNet2. The adatum.com zone is configured as shown in the following exhibit:
Hot Area:
Answer:
Box 1: No -
Box 2: No -
Forward DNS resolution is supported across virtual networks that are linked to the private zone as
resolution virtual networks. VM5 does belong to a resolution virtual network.
Box 3: Yes -
By default, registration virtual networks also act as resolution virtual networks, in the sense that DNS
resolution against the zone works from any of the virtual machines within the registration virtual
network.
Reference:
Question #77
HOTSPOT -
The subscription contains the private DNS zones shown in the following table.
You add virtual network links to the private DNS zones as shown in the following table.
Hot Area:
Answer:
Reference:
https://docs.microsoft.com/en-us/azure/dns/private-dns-virtual-network-links
Question #78
HOTSPOT -
You plan to use an Azure Resource Manager template to deploy a virtual network named VNET1 that
will use Azure Bastion.
How should you complete the template? To answer, select the appropriate options in the answer
area.
Hot Area:
Answer:
Reference:
https://medium.com/charot/deploy-azure-bastion-preview-using-an-arm-template-15e3010767d6
Question #79

 A. Yes
 B. No
Answer: A
Reference:
Question #80
 A. Yes
 B. No
Answer: B
Reference:
Question #81
 A. Yes
 B. No
Answer: B
Reference:
- Question Set 5
Question #1
HOTSPOT -
You enable password reset for contoso.onmicrosoft.com as shown in the Password Reset exhibit.
(Click the Password Reset tab.)
You configure the authentication methods for password reset as shown in the Authentication
Methods exhibit. (Click the Authentication Methods tab.)
Hot Area:
Answer:
Box 1: No -
Box 2: No -
Box 3: Yes -
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/authentication/active-directory-
passwords-faq
Question #2
The company's security policy states that all personal devices and corporate-owned devices must be
registered or joined to Azure AD.
What should you do?
 A. Assign the User administrator role to User1.

 B. From the Device settings blade, modify the Maximum number of devices per user setting.
 C. Create a point-to-site VPN from the home network of User1 to Azure.
 D. From the Device settings blade, modify the Users may join devices to Azure AD setting.
Answer: B
The Maximum number of devices setting enables you to select the maximum number of devices that
a user can have in Azure AD. If a user reaches this quota, they will not be able to add additional
devices until one or more of the existing devices are removed.
Incorrect Answers:
D: The Users may join devices to Azure AD setting enables you to select the users who can join
Reference:
Question #3

 A. Yes
 B. No
Answer: A
Reference:
Question #4

 A. Service Map
 B. Connection troubleshoot
 C. Network Performance Monitor
 D. Effective routes
Answer: C
Network Performance Monitor is a cloud-based hybrid network monitoring solution that helps you
monitor network performance between various points in your network infrastructure. It also helps
you monitor network connectivity to service and application endpoints and monitor the
performance of Azure ExpressRoute.
You can monitor network connectivity across cloud deployments and on-premises locations,
multiple data centers, and branch offices and mission-critical multitier applications or microservices.
With Performance Monitor, you can detect network issues before users complain.
Reference:
Question #5
DRAG DROP -
You need to restore the deleted files to an on-premises Windows Server 2016 computer as quickly
as possible.
Which four actions should you perform in sequence? To answer, move the appropriate actions from
the list of actions to the answer area and arrange them in the correct order.
Select and Place:
Answer:
Step 1: From the Azure portal, click File Recovery from the vault
Step 2. Select a restore point that contains the deleted files
Step 3: Download and run the script to mount a drive on the local computer
Generate and download script to browse and recover files:
Step 4: Copy the files using File Explorer!
After the disks are attached, use Windows File Explorer to browse the new volumes and files. The
restore files functionality provides access to all files in a recovery point. Manage the files via File
Explorer as you would for normal files.
Step 1-3 below:
To restore files or folders from the recovery point, go to the virtual machine and perform the
following steps:
1. Sign in to the Azure portal and in the left pane, select Virtual machines. From the list of virtual
machines, select the virtual machine to open that virtual machine's dashboard.
2. In the virtual machine's menu, select Backup to open the Backup dashboard.
3. In the Backup dashboard menu, select File Recovery.
The File Recovery menu opens.

4. From the Select recovery point drop-down menu, select the recovery point that holds the files you
want. By default, the latest recovery point is already selected.
5. Select Download Executable (for Windows Azure VMs) or Download Script (for Linux Azure VMs, a
python script is generated) to download the software used to copy files from the recovery point.
Running the script and identifying volumes:
For Linux machines, a python script is generated. Download the script and copy it to the
relevant/compatible Linux server.
Reference:
https://docs.microsoft.com/en-us/azure/backup/backup-azure-vms-automation#restore-files-from-
an-azure-vm-backup
Question #6
HOTSPOT -
You create a virtual machine named VM1 in Subscription1. VM1 is not protected by Azure Backup.
You need to protect VM1 by using Azure Backup. Backups must be created at 01:00 and stored for
30 days.
Hot Area:
Answer:

You can set up a Recovery Services vault and configure backup for multiple Azure VMs.
Box 2: A backup policy -

In Choose backup policy, do one of the following:
➨ Leave the default policy. This backs up the VM once a day at the time specified, and retains
backups in the vault for 30 days.
➨ Select an existing backup policy if you have one.
➨ Create a new policy, and define the policy settings.
Reference:
Question #7
You are creating an alert rule in Azure Monitor to notify an administrator when an error is logged in
the System event log of VM1.
Which target resource should you monitor in the alert rule?
 A. virtual machine extension

 B. virtual machine
 C. metric alert
 D. Azure Log Analytics workspace
Answer: D
For the first step to create the new alert tule, under the Create Alert section, you are going to select
your Log Analytics workspace as the resource, since this is a log based alert signal.
Reference:
https://docs.microsoft.com/en-us/windows-server/storage/storage-spaces/configure-azure-monitor
Question #8
What should you do?
 A. From Azure Cost Management, view Cost Analysis

 B. From Azure Advisor, modify the Advisor configuration
 C. From Microsoft Azure Storage Explorer, view the Account Management properties
 D. From Azure Cost Management, view Advisor Recommendations
Answer: D
From Home ‫ג‬€"> Cost Management + Billing ‫ג‬€"> Cost Management, scroll down on the options and
select View Recommendations:
Azure Cost Management / Advisor -

From here you will see the recommendations for your subscription, if you have orphaned disks, they
will be listed.
Reference:
https://codeserendipity.com/2020/07/08/microsoft-azure-find-unattached-disks-that-can-be-
deleted-and-other-recommendations/
Question #9
You need to provide the developers of webapp1 with real-time access to the connection errors. The
solution must provide all the connection error details.
 A. From webapp1, enable Web server logging

 B. From Azure Monitor, create a workbook
 C. From Azure Monitor, create a Service Health alert
 D. From webapp1, turn on Application Logging
Answer: A
Question #10
You have an Azure subscription that has a Recovery Services vault named Vault1. The subscription
contains the virtual machines shown in the following table:

 A. VM1 and VM3 only

 B. VM1, VM2, VM3 and VM4
 C. VM1 and VM2 only
 D. VM1 only
Answer: B
Azure Backup supports backup of 64-bit Windows server operating system from Windows Server
2008.
Reference:
Question #11
HOTSPOT -
Hot Area:
Answer:
Box 1: 10 years -
Box 2: 36 months -
The monthly backup point occurs on the 1
of every month and its retention period is 36 months.
st
Question #12
 A. Create a new Recovery Services vault

 B. Create a storage account
 C. Configure the extensions for VM3 and VM4
 D. Create a new backup policy
Answer: A
A Recovery Services vault is a storage entity in Azure that houses data. The data is typically copies of
data, or configuration information for virtual machines
(VMs), workloads, servers, or workstations. You can use Recovery Services vaults to hold backup
data for various Azure services
Reference:
Question #13
HOTSPOT -
You have an Azure subscription that contains an Azure Storage account named storage1 and the
You plan to monitor storage1 and to configure email notifications for the signals shown in the
following table.
You need to identify the minimum number of alert rules and action groups required for the planned
monitoring.
How many alert rules and action groups should you identify? To answer, select the appropriate
Hot Area:
Answer:
Question #14
You have an Azure subscription that contains the identities shown in the following table.
User1, Principal1, and Group1 are assigned the Monitoring Reader role.
An action group named AG1 has the Email Azure Resource Manager Role notification type and is
configured to email the Monitoring Reader role.
You create an alert rule named Alert1 that uses AG1.
You need to identity who will receive an email notification when Alert1 is triggered.
Who should you identify?
 A. User1 and Principal1 only

 B. User1, User2, Principal1, and Principal2
 C. User1 only
 D. User1 and User2 only
Answer: D
Email will only be sent to Azure AD user members of the Monitoring Reader role. Email will not be
sent to Azure AD groups or service principals.
Reference:
https://docs.microsoft.com/en-us/azure/azure-monitor/platform/action-groups
Question #15
HOTSPOT -

How many recovery points are available on January 8 and January 15? To answer, select the
Hot Area:
Answer:
Box 1: 6 -
5 latest daily recovery points, which includes the weekly backup from the previous Sunday, plus the
monthly recovery point.
Box 2: 8 -
Reference:
https://social.technet.microsoft.com/Forums/en-US/854ab6ae-79aa-4bad-ac65-
471c4d422e94/daily-monthly-yearly-recovery-points-and-storage-used?
forum=windowsazureonlinebackup
- Testlet 1
Question #1
Introductory InfoCase study -

would like to complete each case. However, there may be additional case studies and sections on
this exam. You must manage your time to ensure that you are able to complete all questions
To answer the questions included in a case study, you will need to reference information that is
provided in the case study. Case studies might contain exhibits and other resources that provide
more information about the scenario that is described in the case study. Each question is
At the end of this case study, a review screen will appear. This screen allows you to review your
answers and to make changes before you move to the next section of the exam. After you begin a
new section, you cannot return to this section.

To display the first question in this case study, click the Next button. Use the buttons in the left pane
to explore the content of the case study before you answer the questions. Clicking these buttons
displays information such as business requirements, existing environment, and problem statements.
If the case study has an All Information tab, note that the information displayed is identical to the
information displayed on the subsequent tabs. When you are ready to answer a question, click the
Question button to return to the question.
Overview -
maintains.
File servers
Domain controllers
A SQL database -
A web front end

Requirements -
Planned Changes -
Ensure that when users join devices to Azure Active Directory (Azure AD), the users use a mobile
phone to verify their identity.
User Requirements -
Ensure that a new user named User3 can create network objects for the Azure
subscription.QuestionHOTSPOT -
requirements.
area.
Hot Area:
Answer:
Box 1: Selected -
Box 2: Yes -
Question #2


Overview -
maintains.
File servers
Domain controllers
A SQL database -
A web front end

Requirements -
Planned Changes -
User Requirements -
subscription.QuestionYou need to meet the user requirement for Admin1.
What should you do?
 A. From the Azure Active Directory blade, modify the Groups

 B. From the Azure Active Directory blade, modify the Properties
 C. From the Subscriptions blade, select the subscription, and then modify the Access control (IAM)
settings
 D. From the Subscriptions blade, select the subscription, and then modify the Properties
Answer: C
Scenario:
➨ Designate a new user named Admin1 as the service admin for the Azure subscription.
➨ Admin1 must receive email alerts regarding service outages.
Follow these steps to change the Service Administrator in the Azure portal.
1. Make sure your scenario is supported by checking the limitations for changing the Service
Administrator.
2. Sign in to the Azure portal as the Account Administrator.
3. Open Cost Management + Billing and select a subscription.
4. In the left navigation, click Properties.
5. Click Service Admin.
Reference:
https://docs.microsoft.com/en-us/azure/role-based-access-control/classic-administrators
- Testlet 2
Question #1


Overview -
maintains.
File servers
Domain controllers
A SQL database -
A web front end

Requirements -
Planned Changes -

User Requirements -
subscription.QuestionYou need to implement a backup solution for App1 after the application is
moved.
 A. a recovery plan
 B. an Azure Backup Server
 C. a backup policy
 D. a Recovery Services vault
Answer: D
A Recovery Services vault is a logical container that stores the backup data for each protected
resource, such as Azure VMs. When the backup job for a protected resource runs, it creates a
recovery point inside the Recovery Services vault.
Scenario:
Reference:
Question #2



Overview -
maintains.
File servers
Domain controllers
A SQL database -
A web front end

Requirements -
Planned Changes -
User Requirements -
subscription.QuestionYou need to move the blueprint files to Azure.
What should you do?
 A. Generate an access key. Map a drive, and then copy the files by using File Explorer.
 B. Use Azure Storage Explorer to copy the files.
 C. Use the Azure Import/Export service.
 D. Generate a shared access signature (SAS). Map a drive, and then copy the files by using File
Explorer.
Answer: B
Azure Storage Explorer is a free tool from Microsoft that allows you to work with Azure Storage data
on Windows, macOS, and Linux. You can use it to upload and download data from Azure blob
storage.
Scenario:
Reference:
https://docs.microsoft.com/en-us/azure/machine-learning/team-data-science-process/move-data-
to-azure-blob-using-azure-storage-explorer
Question #3


Overview -
maintains.
File servers
Domain controllers
A SQL database -
A web front end

Requirements -
Planned Changes -

User Requirements -
Hot Area:
Answer:
Box 1: Yes -
Use unmanaged standard storage for the hard disks of the virtual machines. We use Page Blobs for
these.
Box 2: No -
Box 3: No -
- Testlet 3
Question #1


Overview -
Litware, Inc. is a consulting company that has a main office in Montreal and two branch offices in
Seattle and New York.
The Montreal office has 2,000 employees. The Seattle office has 1,000 employees. The New York
office has 200 employees.
Litware creates a new Azure subscription. The Azure Active Directory (Azure AD) tenant uses a
domain named litware.onmicrosoft.com. The tenant uses the
The network contains an Active Directory forest named litware.com. All domain controllers are
configured as DNS servers and host the litware.com DNS zone.
Litware has finance, human resources, sales, research, and information technology departments.
Each department has an organizational unit (OU) that contains all the accounts of that respective
department. All the user accounts have the department attribute set to their respective department.
New users are added frequently.
Litware has data centers in the Montreal and Seattle offices. Each office has a firewall that can be
configured as a VPN device.
All infrastructure servers are virtualized. The virtualization environment contains the servers in the
following table.
Litware uses two web applications named App1 and App2. Each instance on each web application
requires 1 GB of memory.
Requirements -
Planned Changes -
Ensure that WebApp1 can adjust the number of instances automatically based on the load and can
scale up to five instances.
Ensure that VM3 can establish outbound connections over TCP port 8080 to the applications servers
in the Montreal office.
Ensure that routing information is exchanged automatically between Azure and the routers in the
Montreal office.
Minimize costs whenever possible.QuestionYou discover that VM3 does NOT meet the technical
requirements.
 A. Diagram in VNet1
 B. Diagnostic settings in Azure Monitor
 C. Diagnose and solve problems in Traffic Manager profiles
 D. The security recommendations in Azure Advisor
 E. IP flow verify in Azure Network Watcher
Answer: E
consists of direction, protocol, local IP, remote IP, local port, and remote port. If the packet is denied
by a security group, the name of the rule that denied the packet is returned. While any source or
destination IP can be chosen,
IP flow verify helps administrators quickly diagnose connectivity issues from or to the internet and
from or to the on-premises environment.
Reference:
Topic 9 - Testlet 4
Question #1Topic 9


Overview -
following table.
Requirements -
Planned Changes -
Montreal office.
Minimize costs whenever possible.QuestionHOTSPOT -
Hot Area:
Answer:

Azure VPN gateway. The VPN gateway service enables you to connect the VNet to the on-premises
network through a VPN appliance. For more information, see
Connect an on-premises network to a Microsoft Azure virtual network. The VPN gateway includes
the following elements:
➨ Virtual network gateway. A resource that provides a virtual VPN appliance for the VNet. It is
responsible for routing traffic from the on-premises network to the
VNet.
➨ Local network gateway. An abstraction of the on-premises VPN appliance. Network traffic from
the cloud application to the on-premises network is routed through this gateway.
➨Connection. The connection has properties that specify the connection type (IPSec) and the key
shared with the on-premises VPN appliance to encrypt traffic.
➨ Gateway subnet. The virtual network gateway is held in its own subnet, which is subject to
various requirements, described in the Recommendations section below.
gateway.
Incorrect Answers:
Reference:
networking/vpn
0 - Testlet 5
Question #10


Overview -
maintains.
File servers
Domain controllers
A SQL database -
A web front end

Requirements -
Planned Changes -
User Requirements -
What should you include in the recommendation? To answer, select the appropriate options in the
answer area.
Hot Area:
Answer:
This reference architecture shows how to deploy VMs and a virtual network configured for an N-tier
application, using SQL Server on Windows for the data tier.
Scenario: You have a public-facing application named App1. App1 is comprised of the following three
tiers:
➨ A SQL database
➨ A web front end
➨A processing middle tier
➨ Move all the virtual machines for App1 to Azure.
➨Minimize the number of open ports between the App1 tiers.
Reference:
https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/n-tier/n-tier-sql-
server
Question #20


Overview -
maintains.
File servers
Domain controllers
A SQL database -
A web front end

Requirements -
Planned Changes -
User Requirements -
subscription.QuestionYou are planning the move of App1 to Azure.
You create a network security group (NSG).
You need to recommend a solution to provide users with access to App1.

 A. Create an incoming security rule for port 443 from the Internet. Associate the NSG to the subnet
that contains the web servers.
 B. Create an outgoing security rule for port 443 from the Internet. Associate the NSG to the subnet
that contains the web servers.
 C. Create an incoming security rule for port 443 from the Internet. Associate the NSG to all the
subnets.
 D. Create an outgoing security rule for port 443 from the Internet. Associate the NSG to all the
subnets.
Answer: A
Incoming and the web server subnet only, as users access the web front end by using HTTPS only.
Note Scenario: You have a public-facing application named App1. App1 is comprised of the following
three tiers:
➨ A SQL database
➨ A web front end
➨ A processing middle tier
1 - Testlet 6
1 - Testlet 6
Question #1


Overview -
following table.
Requirements -
Planned Changes -
Montreal office.
Minimize costs whenever possible.QuestionHOTSPOT -
Which command should you run before you create Role1? To answer, select the appropriate options
in the answer area.
Hot Area:
Answer:
Question #21


Overview -
following table.
Requirements -
Planned Changes -
Montreal office.
Minimize costs whenever possible.QuestionYou need to recommend a solution to automate the
configuration for the finance department users. The solution must meet the technical requirements.
 A. Azure AD B2C
 B. dynamic groups and conditional access policies
 C. Azure AD Identity Protection
 D. an Azure logic app and the Microsoft Identity Management (MIM) client
Answer: B
only.
Reference:

AZ 104 (0) Merged

Uploaded by

Copyright:

Available Formats

AZ 104 (0) Merged

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

AZ 104 (0) Merged

Uploaded by

Copyright:

Available Formats

Vendor: Microsoft

Exam Code: AZ-104

Exam Name: Microsoft Azure Administrator

Order ID: ****************

PayPal Name: ****************

PayPal ID: ****************

NOTE: Each correct selection is worth one point.

What should you deploy?

A. all three virtual machines in a single Availability Zone

What can you configure during the deployment of VM2?

What task should you include in the runbook?

A. Add the Azure Performance Diagnostics agent to VM1.

Does this meet the goal?

VM1 hosts a frontend application that connects to VM2 to retrieve data.

Users report that the frontend application is slower than usual.

Which Azure Network Watcher feature should you use?

You plan to schedule backups to occur every night at 23:00.

Which virtual machines can you back up by using Azure Backup?

A. VM1 and VM3 only

You need to protect VM3 and VM4 by using Recovery Services.

A. Create a new Recovery Services vault

User1 creates a new Azure Active Directory tenant named external.contoso.onmicrosoft.com.

You need to create new user accounts in external.contoso.onmicrosoft.com.

Solution: You instruct User2 to create the user accounts.

Does that meet the goal?

User1 creates a new Azure Active Directory tenant named external.contoso.onmicrosoft.com.

You need to create new user accounts in external.contoso.onmicrosoft.com.

Solution: You instruct User4 to create the user accounts.

Does that meet the goal?

You need to create new user accounts in external.contoso.onmicrosoft.com.

Solution: You instruct User3 to create the user accounts.

Does that meet the goal?

What should you do first?

A. From contoso.com, modify the Organization relationships settings.

NOTE: Each correct selection is worth one point.

A. an Office 365 group that uses the Assigned membership type

You need to identify which resources can be moved to AZPT2.

Which resources should you identify?

A. VM1, storage1, VNET1, and VM1Managed only

What should you do?

A. From Azure PowerShell, run the Set-AzApiManagementSubscription cmdlet

NOTE: Each correct selection is worth one point.

A. Add a service endpoint to VNet1

What should you configure?

A. Floating IP (direct server return) to Enabled

You have an Azure subscription that contains the following resources:

- A web app named webapp1

You need to ensure that webapp1 can connect to Share1.

What should you deploy?

A. an Azure Application Gateway

What should you use?

A. Azure Active Directory (Azure AD) Application Proxy

A. From webapp1, enable Web server logging

You create a new user account named AdminUser1.

You need to assign the User administrator administrative role to AdminUser1.

What should you do from the user account properties?

A. From the Licenses blade, assign a new license

You purchase 10 Azure AD Premium P2 licenses for the tenant.

What should you do?