Microsoft Practice Questions, Discussions & Exam Topics by our Authors
Your on-premises network contains a VPN gateway.
You have an Azure subscription that contains the resources shown in the following table.
You need to ensure that all the traffic from VM1 to...
To ensure that all the traffic from VM1 to Storage1 travels across the Microsoft backbone network, we need to examine the options given, considering the objective is to direct traffic over the Azure backbone network and avoid routing over the public internet.
A) Azure AD Application Proxy
- Explanation: Azure AD Application Proxy is used for providing secure remote access to on-premises applications. It is typically used to expose on-premises web apps to the internet securely and is not designed for routing traffic to Azure resources like Storage accounts.
- Why rejected: This service is irrelevant to the scenario of routing traffic between a virtual machine and Azure storage, as it is intended for exposing on-premises applications to external users securely.
B) Private Endpoints
- Explanation: A Private Endpoint allows you to connect to Azure services like Storage over a private IP address within your virtual network. This ensures that the traffic between VM1 and Storage1 goes over the Azure backbone network instead of the public internet.
- Why selected: Using Private Endpoints ensures that all traffic from VM1 to Storage1 is routed over the Microsoft backbone network because the storage account will be mapped to a private IP address within the Azure virtual network, thus preventing the traffic from going over the public...
Author: Ahmed · Last updated Jul 27, 2026
Your on-premises network contains a VPN gateway.
You have an Azure subscription that contains the resources shown in the following table.
You need to ensure that all the traffic from VM1 to...
To ensure that all the traffic from VM1 to Storage1 travels across the Microsoft backbone network, we need to focus on options that allow secure and private communication between Azure resources without utilizing the public internet. Let's analyze the options:
A) Azure AD Application Proxy
- Explanation: Azure AD Application Proxy is designed to provide secure remote access to on-premises applications. It allows organizations to expose on-premises web applications to external users securely.
- Why rejected: This is unrelated to your scenario, as it doesn't provide a way to route traffic between Azure resources (VM1 and Storage1) over the Microsoft backbone network. It’s for securely publishing on-premises applications to the internet, not for traffic routing within Azure.
B) Service Endpoints
- Explanation: Service Endpoints extend your virtual network's private IP address range to specific Azure services, such as Storage1, over the Azure backbone network. By enabling service endpoints on the subnet where VM1 resides, you can ensure that traffic to the Azure service (Storage1) flows over the Microsoft backbone network instead of the public internet.
- Why selected: Service Endpoints are a key feature for ensuring traffic from a VM to an Azure service (like Storage) stays within the Azure backbone network, making this the ideal choice for this scenario. Service endp...
Author: Andrew · Last updated Jul 27, 2026
Your on-premises network contains a VPN gateway.
You have an Azure subscription that contains the resources shown in the following table.
You need to ensure that all the traffic from VM1 to...
To ensure that all traffic from VM1 to Storage1 travels across the Microsoft backbone network, let's analyze the provided options:
A) Azure Application Gateway
- Explanation: Azure Application Gateway is a web traffic load balancer that enables you to manage traffic to your web applications. It can perform functions like SSL termination, cookie-based session affinity, and web application firewall features.
- Why rejected: This service is designed to route HTTP/HTTPS traffic to web applications, not to ensure that traffic between resources like a VM and a storage account remains on the Azure backbone network. It is primarily for web traffic, not internal traffic routing between resources like a VM and storage account.
B) Service Endpoints
- Explanation: Service Endpoints provide direct access to Azure services like Storage over a private IP address within a virtual network, ensuring the traffic between VM1 and Storage1 stays on the Microsoft backbone network. By enabling service endpoints, the traffic between the VM and Azure Storage will bypass the public internet and flow over the private, secure backbone network.
- Why selected: Service Endpoints are specifically designed to route traffic from resources in a virtual network to Azure services (like Storage) over the Azure backbone network, which is exactly what is required in this case. This is the optimal solution for ensuring traffic stays within Azure’s private network....
Author: Michael · Last updated Jul 27, 2026
You have an Azure subscription named Sub1 that contains the resources shown in the following table.
You create a user named Ad...
To determine where you can add Admin1 as a co-administrator, we need to review each option carefully, considering the Azure management structure and the co-administrator role.
A) RG1 (Resource Group)
- Explanation: A Resource Group (RG) is a logical container in Azure for grouping resources like virtual machines, storage accounts, and virtual networks. You can assign roles at the resource group level, but a co-administrator role is not typically assigned directly to a resource group.
- Why rejected: In Azure, roles like Owner, Contributor, or Reader can be assigned at the resource group level, but the co-administrator role is specifically tied to Azure subscriptions and not individual resource groups. Hence, you cannot assign Admin1 as a co-administrator to a resource group.
B) MG1 (Management Group)
- Explanation: Management Groups (MG) are used for organizing and managing Azure subscriptions across multiple levels, typically used in large enterprises to manage policies and access at a higher level across subscriptions.
- Why rejected: The co-administrator role cannot be assigned directly at the management group level. Instead, you assign roles at the subscription level, which is linked to a management group, but the co-administrator role doesn’t apply directly at this higher level.
C)...
Author: FlamePhoenix2025 · Last updated Jul 27, 2026
SNAPSHOT
-
You have a Microsoft Entra tenant that contains the groups shown in the following table.
The tenant contains the users shown in the following table.
Which users and groups can you delete? To answer, se...
Author: NebulaEagle11 · Last updated Jul 27, 2026
You have an Azure subscription that contains the resources shown in the following table.
You need to ensure that data transfers between storage1 and VM1 d...
To ensure that data transfers between `storage1` and `VM1` do not traverse the internet, we need to configure `storage1` in such a way that it ensures private and secure communication within the Azure network. Let’s evaluate each option:
A) Data Protection
- Explanation: Data protection settings mainly focus on securing data at rest and in transit (encryption). While this is crucial for maintaining data confidentiality and integrity, it does not specifically address how data transfers between `storage1` and `VM1` occur or whether they traverse the internet. Therefore, it will not prevent data from traversing the internet.
- Rejection Reason: This option does not impact the routing of traffic between resources in terms of preventing internet traversal.
B) A Private Endpoint
- Explanation: A Private Endpoint enables secure access to Azure Storage over a private IP address within your virtual network. By configuring a Private Endpoint for `storage1`, you ensure that traffic from `VM1` to `storage1` will travel over the private Azure backbone network rather than the public internet, preventing data from traversing the internet.
- Rejection Reason: None. This is the ideal solution for ensuring the data transfers between `VM1` and `storage1` do not traverse the internet.
C) Public Network Access in the Firewalls and Virtual Networks Settings
...
Author: Ishaan · Last updated Jul 27, 2026
SNAPSHOT
-
You have a Microsoft Entra tenant that is linked to the subscriptions shown in the following table.
You have the resource groups shown in the following table.
You assign roles to users as shown in the following table.
For each of the following s...
Author: Liam123 · Last updated Jul 27, 2026
Your on-premises network contains a VPN gateway.
You have an Azure subscription that contains the resources shown in the following table.
You need to ensure that all the traffic from VM1 to...
To ensure that all traffic from `VM1` to `storage1` travels across the Microsoft backbone network and not the internet, you need to focus on configuring a method that forces traffic to remain within Azure’s private network infrastructure.
Let’s evaluate each option in detail:
A) Network Security Group (NSG)
- Explanation: A Network Security Group (NSG) is primarily used to control inbound and outbound traffic at the network interface level or subnet level by defining rules based on IP addresses, ports, and protocols. However, an NSG does not affect the routing of traffic between resources or ensure that traffic stays on the private network. It only controls whether traffic is allowed or denied based on defined rules.
- Rejection Reason: While NSGs are useful for controlling traffic, they do not enforce or guarantee that the traffic between `VM1` and `storage1` will traverse the Microsoft backbone network. It only controls access to resources, not routing.
B) Private Endpoints
- Explanation: Private Endpoints provide private IP addresses within your virtual network for accessing Azure services (like Azure Storage) over the Azure backbone network. When you configure a Private Endpoint for `storage1`, all traffic from `VM1` to `storage1` will be routed over the Microsoft backbone network (via the private IP address). This is the ideal solution for ensuring that traffic does not traverse the internet and stays within Azure's secure network.
- Rejection Reason: None. This is the correct solution because it directly addresses the need for ensuring that traffic between `VM1` and `storage1` stays within the Azure private network.
C) Microsoft Entra Application Proxy
- Explanation: Microsoft Entra Applicati...
Author: MoonlitPantherX · Last updated Jul 27, 2026
You have a Microsoft Entra tenant.
You plan to perform a bulk import of users.
You need to ensure that imported user objects are added automatically as the members of a specific group based on each user's department. The solution must minimize administrative effort.
Which two actio...
In this scenario, the goal is to perform a bulk import of users into Microsoft Entra and automatically add them to a group based on their department, while minimizing administrative effort. Let’s evaluate each option to find the most efficient and relevant solution.
A) Create groups that use the Assigned membership type
- Explanation: Assigned membership type means that users are manually added to the group. This would require administrative effort to assign users to the group individually. Given that we are aiming to minimize administrative effort, this option does not align well with the goal.
- Rejection Reason: This option requires manual intervention and doesn't meet the requirement for automatic group membership based on department.
B) Create an Azure Resource Manager (ARM) template
- Explanation: Azure Resource Manager (ARM) templates are primarily used for deploying and managing resources in Azure. While ARM templates can automate resource provisioning, they are not used for bulk importing users or dynamically assigning users to groups based on attributes such as department.
- Rejection Reason: ARM templates are not suitable for user management tasks like bulk import and dynamic group membership.
C) Create groups that use the Dynamic User membership type
- Explanation: Dynamic User membership allows Azure Active Directory (Azure AD) to automatically add or remove users from a group based on attributes such as department, job title, etc. This is the best approach to automate the group membership based on each user's department, as it eliminates the need for manual intervention after the user import.
- Rejection Reason: None. This is the correct solution for ensuring users are automatically added to groups based on their department without manual effort.
D) Write a PowerShell script that parses an import file
- Explanation: While PowerShell scripts can be useful for bulk importing users and assigning them to groups, this approac...
Author: Lucas · Last updated Jul 27, 2026
You have an Azure subscription that contains a storage account named storage1.
You need to ensure that the access keys for stor...
To ensure that the access keys for a storage account, such as `storage1`, rotate automatically, the solution must provide a way to manage secrets securely and rotate them without manual intervention.
Let’s evaluate each option:
A) A Backup Vault
- Explanation: A Backup Vault is used for backup and recovery purposes within Azure. It is used to store backup data for resources such as virtual machines and databases. It does not manage or rotate access keys for Azure Storage accounts.
- Rejection Reason: This option is not relevant for rotating access keys for storage accounts. It focuses on backup and recovery, not key management.
B) Redundancy for Storage1
- Explanation: Redundancy settings in Azure Storage (such as geo-redundant storage (GRS), locally redundant storage (LRS), etc.) ensure that the data within the storage account is replicated across regions or within a region for high availability and durability. However, redundancy does not provide any mechanism for managing or rotating access keys.
- Rejection Reason: Redundancy is focused on data availability and durability, not on rotating access keys.
C) Lifecycle Management for Storage1
- Explanation: Lifecycle Management in Azure Storage allows you to automate the management of your data, such as moving it to different tiers (Hot, Cool, Archive) or deleting expired data. While lifecycle management helps with organizing data storage, it does not manage ...
Author: Liam · Last updated Jul 27, 2026
You have an Azure subscription that contains the Microsoft Entra identities shown in the following table.
You need to enable self-service password reset (S...
In Azure, Self-Service Password Reset (SSPR) can be enabled for individual users, security groups, or both. To determine which identities can have SSPR enabled, we need to examine whether the identities meet the requirements and criteria for enabling SSPR.
Key Factors:
1. User identities: SSPR can be enabled for individual users in Microsoft Entra (Azure AD). Users must be in an appropriate directory, and the organization must have a license that supports this feature (e.g., Azure AD Premium P1 or higher).
2. Group identities: You can enable SSPR for a security group in Azure AD. However, for a group, SSPR applies to the members of the group, not the group itself. The individual users in the group must be eligible for SSPR.
3. Licensing and availability: SSPR can be enabled only for identities that are assigned appropriate licensing. If a user or group does not have the required Azure AD license, they won't be able to use SSPR.
Analysis of each option:
A) User1 only
- Selected option: If User1 has the correct Azure AD licensing (e.g., Azure AD Premium P1 or higher), SSPR can be enabled. This would apply only to User1, and no groups are involved in this option.
- Why rejected: This would only apply to User1, so other users (e.g., those in groups) are excluded, which limits the flexibility.
B) Group1 only
- Rejected option: Groups can have SSPR enabled, but only for members of the group. If Group1 does not have users that meet the requirements (or the group doesn't contain eligible users), enabling SSPR for Group1 will have no effect. Also, groups themselves do not directly enable or use SSPR, only the members do.
- Why rejected: Groups o...
Author: Carlos Garcia · Last updated Jul 27, 2026
DRAG DROP -
You have a Microsoft Entra tenant.
You need to ensure that when a new Microsoft 365 group is created, the group name is automatically formatted as follows:
Which three actions should you perform in sequence in the Microsoft Entra admin center? To a...
Author: Amelia · Last updated Jul 27, 2026
SNAPSHOT
-
You have a Microsoft Entra tenant that contains the users shown in the following table.
The tenant contains the groups shown in the following table.
Which users and groups can be deleted? To answer, se...
Author: Ella · Last updated Jul 27, 2026
SNAPSHOT
-
You have an Azure subscription that contains the resources shown in the following table.
You plan to use an Azure key vault to provide a secret to app1.
What should you create for app1 to access the key vault, and from which key vault can the secret be...
Author: Isabella · Last updated Jul 27, 2026
You have a Microsoft Entra tenant named contoso.com.
You collaborate with an external partner named fabrikam.com.
You plan to invite users in fabrikam.com to the contoso.com tenant.
You need to ensure that invitations ...
To ensure that invitations can only be sent to users in the fabrikam.com domain and no other external users, we need to focus on limiting invitations to a specific domain (fabrikam.com) and configuring the appropriate collaboration restrictions.
Key Factors:
1. Cross-tenant access settings: These settings are used to manage collaboration and access between different tenants, including settings like which external organizations (like fabrikam.com) are allowed to access resources within the contoso.com tenant.
2. External collaboration settings: These settings define how external users can be invited into your tenant, including restrictions on who can receive invitations and what level of access external users have.
3. Guest user access restrictions: This setting allows you to limit or restrict access for guest users based on different criteria (e.g., group membership or domains).
4. Collaboration restrictions: This setting specifically controls which external domains are allowed to collaborate with your tenant. You can specify that only users from fabrikam.com are invited as guest users to contoso.com.
Analysis of Each Option:
A) From Cross-tenant access settings, configure the Tenant restrictions settings
- Rejected option: Cross-tenant access settings are primarily used for managing access between tenants and specifying how users from other tenants can interact with your tenant. The Tenant restrictions settings in this section are more focused on controlling access across the entire tenant, but it doesn't directly control invitations to a specific domain like fabrikam.com. It is more about access policies between different Azure AD tenants.
- Why rejected: This does not directly meet the requirement of restricting invitations only to fabrikam.com.
B) From Cross-te...
Author: Ava · Last updated Jul 27, 2026
You have an Azure subscription that contains a storage account named storage1. The storage1 account contains blob data.
You need to assign a role to a user named User1 to ensure that the user can access the blob data in storage1. The role assignment must support conditions.
Which two roles...
To ensure User1 can access the blob data in storage1 with a role that supports conditions, we need to choose roles that allow granular control and conditional access based on the Azure Role-Based Access Control (RBAC) system. The correct roles also need to be specific to blob data.
Let's go through the options:
A) Owner
- Explanation: The Owner role grants full access to manage all resources in the Azure subscription, including the ability to assign roles to others. However, it does not provide conditional access at a more granular level (such as for specific blob data). The Owner role applies to the entire resource group or subscription level, not specific to blob data. Therefore, it's not the right choice here.
- Why rejected: Does not provide the necessary condition-based access to blob data.
B) Storage Account Contributor
- Explanation: The Storage Account Contributor role grants permissions to manage storage accounts, but it does not grant access to the data within the storage account, such as blob data. This role allows users to configure the storage account, but not to manage or access the content inside it.
- Why rejected: This role does not support blob-level access; it is for managing the storage account itself.
C) Storage Account Backup Contributor
- Explanation: The Storage Account Backup Contributor role grants permissions related to backup operations in the storage account. While it allows management of backup services, it does not grant access to the blob data itself for general operations like read, write, or modify.
- Why rejected: This role is more specialized toward backup and does not grant access to the blob data directly.
D...
Author: Julian · Last updated Jul 27, 2026
SNAPSHOT
-
Case study
-
This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided.
To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study.
At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new section, you cannot return to this section.
To start the case study
-
To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. If the case study has an All Information tab, note that the information displayed is identical to the information dis...
Author: Zara · Last updated Jul 27, 2026
You have a Microsoft Entra tenant configured as shown in the following exhibit.
The tenant contains the identities shown in the following table.
You purchase a M...
To determine which identities you can assign the Microsoft Fabric license to, we need to consider the types of identities in Microsoft Entra and their suitability for license assignment. In Microsoft Entra, you can assign licenses to users and groups that contain users.
Here’s how we evaluate each option based on the identity types:
Identity Types:
- User1: A user identity that can directly have a Microsoft Fabric license assigned.
- Group1: A group that contains User1 (or could contain other users). A license can be assigned to a group, and then each member of the group (like User1) will inherit the license.
- Group2: A group that contains User2 (another user). A license can also be assigned to this group, and User2 will inherit it as well.
Now, let's evaluate each option:
A) User1 only
- Explanation: This option assigns the license only to User1. While this is valid, the scenario may also allow the license to be assigned to groups containing users. Assigning a license to just User1 may be more restrictive than necessary if groups could be leveraged to simplify the management and assignment.
- Why rejected: It’s too restrictive because you can assign licenses to groups as well, which might be a more efficient option if multiple users in the group need the license.
B) User1 and Group1 only
- Explanation: This option assigns the license to User1 directly and to Group1, which contains User1. Since Group1 is already linked to User1, assigning the license to the group will also result in User1 receiving the license. This is a valid option but somewhat redundant because User1 could be assigned the license indiv...
Author: Rohan · Last updated Jul 27, 2026
You have an Azure subscription that contains a storage account named storage. The storage account contains a blob that stores images.
Client access to storage1 is granted by using a shared access signature (SAS).
You need to ensure that users receive a w...
To address the requirement of ensuring that users receive a warning when generating a shared access signature (SAS) that exceeds a seven-day time period, let’s evaluate the options and determine the most appropriate action.
A) Enable a read-only lock
- Explanation: A read-only lock prevents modification or deletion of the storage account, but it does not address the issue of SAS expiry or duration. It is mainly used to prevent accidental changes to the storage account, not for configuring alerts or time restrictions on SAS tokens.
- Why rejected: This option does not fulfill the requirement to warn users about SAS expiration periods or time limits.
B) Configure an alert rule
- Explanation: Configuring an alert rule could be used to monitor certain metrics or actions within the Azure environment, including the usage of SAS tokens. However, there isn’t a built-in metric in Azure to directly alert you when a SAS token with a specific expiry time (like more than seven days) is generated. This would require custom monitoring and isn’t specifically designed for controlling SAS expiration periods.
- Why rejected: While an alert rule could be useful for some use cases, it does not directly solve the issue of limiting SAS expiry times or notifying users when their SAS exceeds a predefined limit.
C) Add a lifecycle management rule
- Explanation: Lifecycle management rules in Azure Storage are used for mana...
Author: Sofia2021 · Last updated Jul 27, 2026
You have an Azure subscription named Subscription1 that contains the storage accounts shown in the following table:
You plan to use the Azure Import/Export service to export data from Subscription1.
You need ...
To identify which storage account can be used for Azure Import/Export service, we need to consider the following important requirements for storage accounts:
1. Azure Import/Export service requires the storage account to be general-purpose v2 (GPv2) or general-purpose v1 (GPv1) storage accounts.
2. The storage account should support blob storage (which is necessary for the Import/Export operations).
Let’s go through each option:
A) storage1
- Explanation: If storage1 is a general-purpose v2 (GPv2) or general-purpose v1 (GPv1) storage account, it could potentially be used for the Azure Import/Export service. However, we do not have enough information to know whether storage1 meets the criteria. If it is a BlobStorage or FileStorage account (which are newer account types), it cannot be used for Azure Import/Export.
- Why rejected: If storage1 is a BlobStorage or FileStorage account, it cannot be used for import/export services.
B) storage2
- Explanation: If storage2 is a general-purpose v2 (GPv2) or general-purpose v1 (GPv1) storage account, it could also be used for the Azure Import/Export service, provided it supports blob storage and meets the import/export criteria.
- Wh...
Author: Layla · Last updated Jul 27, 2026
SNAPSHOT -
You have Azure Storage accounts as shown in the following exhibit.
Use the drop-down menus to select the answer choice that completes each statement based on the information pre...
Author: Lina Zhang · Last updated Jul 27, 2026
You have Azure subscription that includes data in following locations:
You plan to export data by using Azure import/export job named Export1.
You need to identify the d...
When planning to export data using an Azure Import/Export job, the data that can be exported must meet specific requirements. The Azure Import/Export service supports data export from Azure Storage (specifically blob storage and disk-backed storage accounts), and it cannot be used directly to export data from other Azure services such as databases or file shares unless they are in the appropriate format.
Let’s analyze the given options based on this requirement:
A) DB1
- Explanation: DB1 is likely to refer to an Azure SQL Database or another database service. The Azure Import/Export service is not designed to export data from Azure SQL Database or other database types. For databases, there are separate tools, such as Azure Data Export Service or BACPAC files, which are specifically tailored for exporting database data.
- Why rejected: The Azure Import/Export service cannot be used to export data from databases like DB1.
B) container1
- Explanation: Container1 likely refers to a Blob Storage container. The Azure Import/Export service is fully capable of exporting data from Azure Blob Storage containers. This service is designed to export large amounts of data stored in blobs, so if container1 contains the desired data in bl...
Author: Carlos Garcia · Last updated Jul 27, 2026
SNAPSHOT -
You have an Azure Storage account named storage1.
You have an Azure App Service app named App1 and an app named App2 that runs in an Azure container instance. Each app uses a managed identity.
You need to ensure that App1 and App2 can read blobs from storage1. The solution must meet the following requirements:
* Minimize the number of secrets used.
* Ensure that App2 can only read from storage1 for the next...
Author: NebulaEagle11 · Last updated Jul 27, 2026
SNAPSHOT -
You need to create an Azure Storage account that meets the following requirements:
* Minimizes costs
* Supports hot, cool, and archive blob tiers
* Provides fault tolerance if a disaster affects the Azure region where the account resides
How should you complete the comma...
Author: Ahmed · Last updated Jul 27, 2026
You have an Azure subscription that contains the resources in the following table.
Store1 contains a file share named data. Data contains 5,000 files.
You need to synchronize the files in the file share named data to an on-premises server named Server1.
Which three actions ...
To synchronize the files from an Azure file share (in Store1) to an on-premises server (Server1), the Azure File Sync service must be used. This service allows you to synchronize files between an Azure File Share and on-premises servers.
Here’s the breakdown of the necessary steps and actions:
A) Create a container instance
- Explanation: A container instance is used for running containers in Azure but is not directly related to synchronizing files between an Azure File Share and an on-premises server. This action is not part of the Azure File Sync process.
- Why rejected: This is unrelated to file synchronization between Azure and on-premises servers.
B) Register Server1
- Explanation: Before you can sync data between Azure File Share and your on-premises server, Server1 must be registered with Azure File Sync. This allows Server1 to be part of the synchronization process.
- Why selected: Server1 needs to be registered with the Azure File Sync service to enable synchronization. This is a crucial step in the setup.
C) Install the Azure File Sync agent on Server1
- Explanation: The Azure File Sync agent must be installed on Server1. The agent is responsible for managing the synchronization of files between the Azure File Share and the on-premises server.
- Why selected: The Azure File Sync agent is required on Server1 ...
Author: William · Last updated Jul 27, 2026
SNAPSHOT -
You have an Azure subscription that contains the resources shown in the following table.
The status of VM1 is Running.
You assign an Azure policy as shown in the exhibit. (Click the Exhibit tab.)
You assign the policy by using the following parameters:
Microsoft.ClassicNetwork/virtualNetworks
Microsoft.Network/virtualNetworks
Microsoft.Compute/virtualMach...
Author: Amira99 · Last updated Jul 27, 2026
DRAG DROP -
You have an Azure subscription that contains a storage account.
You have an on-premises server named Server1 that runs Windows Server 2016. Server1 has 2 TB of data.
You need to transfer the data to the storage account by using the Azure Import/Export service.
In which order should you perform the actions? To answer, move all actions from the list of actions to the answer area and arr...
Author: Emma Brown · Last updated Jul 27, 2026
SNAPSHOT -
You have Azure subscription that includes following Azure file shares:
You have the following on-premises servers:
You create a Storage Sync Service named Sync1 and an Azure File Sync group named Group1. Group1 uses share1 as a cloud endpoint.
You register Server1 and Server2 in Sync1. You add D:Folder1 on Server1 as a server endpoint of Group1.
...
Author: Grace · Last updated Jul 27, 2026
DRAG DROP -
You have an Azure subscription named Subscription1.
You create an Azure Storage account named contosostorage, and then you create a file share named data.
Which UNC path should you include in a script that references files from the data file share? To answer, drag the appropriate values to the correct targets. Each value may be used once, more than once ...
Author: NebulaEagle11 · Last updated Jul 27, 2026
SNAPSHOT -
You have an Azure subscription that contains an Azure Storage account.
You plan to copy an on-premises virtual machine image to a container named vmimages.
You need to create the container for the planned image.
Which command should you run? To answe...
Author: Nia · Last updated Jul 27, 2026
SNAPSHOT -
You have an Azure File sync group that has the endpoints shown in the following table.
Cloud tiering is enabled for Endpoint3.
You add a file named File1 to Endpoint1 and a file named File2 to Endpoint2.
On which endpoints will File1 and File2 be available within 24 hours of adding the...
Author: Noah Williams · Last updated Jul 27, 2026
SNAPSHOT -
You have several Azure virtual machines on a virtual network named VNet1.
You configure an Azure Storage account as shown in the following exhibit.
Use the drop-down menus to select the answer choice that completes each statement bas...
Author: IceDragon2023 · Last updated Jul 27, 2026
SNAPSHOT -
You have a sync group named Sync1 that has a cloud endpoint. The cloud endpoint includes a file named File1.txt.
Your on-premises network contains servers that run Windows Server 2016. The servers are configured as shown in the following table.
You add Share1 as an endpoint for Sync1. One hour later, you add Share2 as an endpoint for Sync1.
F...
Author: William · Last updated Jul 27, 2026
You have an Azure subscription that contains the storage accounts shown in the following table.
You need to identify which storage account can be converted to zone-redundant storage (ZRS) repli...
In Azure, the ability to convert a storage account to Zone-Redundant Storage (ZRS) replication typically depends on the current replication type of the storage account.
The key factors to understand are:
- ZRS (Zone-Redundant Storage) is a replication option that stores data across multiple availability zones in a region to protect against zone-level failures.
- Live migration to ZRS is generally supported for specific types of storage accounts. For example, a Locally Redundant Storage (LRS) account can be converted to ZRS with a request to Azure support, but other replication types, such as Geo-Redundant Storage (GRS), are typically not directly convertible to ZRS.
Now, let's review the options based on their potential replication types:
A) storage1
- Explanation: If storage1 is using LRS replication, it can be converted to ZRS through a live migration request to Azure support. However, if it is already using GRS or RA-GRS (Geo-Redundant Storage or Read-Access Geo-Redundant Storage), it cannot be directly converted to ZRS.
- Why selected: LRS accounts are eligible for a live migration to ZRS. If storage1 uses LRS, it is the correct candidate for conversion.
B) storage2
- Explanation...
Author: Leah Davis · Last updated Jul 27, 2026
You have an Azure subscription that contains a storage account named account1.
You plan to upload the disk files of a virtual machine to account1 from your on-premises network. The on-premises network uses a public IP address space of
131.107.1.0/24.
You plan to use the disk files to provision an Azure virtual machine named VM1. VM1 will be attached to a virtual network named VNet1. VNet1 uses an IP address space of 192.168.0.0/24.
You need to configure account1 to meet the following requirements:
* Ensure that you can upload the disk files to ac...
To configure account1 (the Azure Storage account) to meet the given requirements, let's go through each of the options and their relevance:
Requirements:
1. Ensure that you can upload the disk files to account1: This means allowing the on-premises network (with the IP range of `131.107.1.0/24`) to access the storage account.
2. Ensure that you can attach the disks to VM1: This means allowing access to the storage account from the virtual network (VNet1) for the virtual machine (VM1).
3. Prevent all other access to account1: This restricts access to only specific IP addresses and VNets, effectively preventing any other access.
A) From the Networking blade of account1, select Selected networks
- Explanation: By selecting "Selected networks", you can configure network rules to specify which IP addresses and VNets are allowed to access the storage account. This is important because it allows you to restrict access to just the on-premises network (for disk uploads) and VNet1 (for VM1 attachment), while blocking all other access.
- Why selected: This is a key step to restricting access and meeting the requirement of preventing all other access to the storage account.
B) From the Networking blade of account1, select Allow trusted Microsoft services to access this storage account
- Explanation: Enabling this option allows trusted Microsoft services (such as Azure Backup, Azure Site Recovery, etc.) to access the storage account. This is not necessary for the task at hand, as we are concerned with allowing access from a specific on-premises network and VNet1, not trusted Microsoft services.
- Why rejected: This option is not relevant to restricting access only to the specified networks and doesn’t align with the requirement to prevent all other access.
C) From the Networking b...
Author: GlowingTiger · Last updated Jul 27, 2026
DRAG DROP -
You have an on-premises file server named Server1 that runs Windows Server 2016.
You have an Azure subscription that contains an Azure file share.
You deploy an Azure File Sync Storage Sync Service, and you create a sync group.
You need to synchronize files from Server1 to Azure.
Which three actions should you perform in seq...
Author: Sophia Clark · Last updated Jul 27, 2026
SNAPSHOT -
You plan to create an Azure Storage account in the Azure region of East US 2.
You need to create a storage account that meets the following requirements:
* Replicates synchronously.
* Remains available if a single data center in the region fails.
How should you configure the storage ...
Author: Rahul · Last updated Jul 27, 2026
You plan to use the Azure Import/Export service to copy files to a storage account.
Which two files should you create before you prepare the drives for the import job? Each correct answer...
When using the Azure Import/Export service to copy files to an Azure Storage account, there are specific files required to properly configure the import job. Let's go through the options and identify which files need to be created before preparing the drives for the import job:
A) An XML manifest file
- Explanation: The XML manifest file is required when using the Azure Import/Export service, particularly when using hard drives (disk drives) to import data into Azure Storage. This file contains metadata about the import job, including information about the data being transferred.
- Why selected: This is a required file that provides details about the data on the drive being imported, and it must be created before preparing the drives for the import job.
B) A dataset CSV file
- Explanation: A dataset CSV file is used when you need to specify the dataset in the Azure Storage account. However, this is not typically a required file for a standard Azure Import/Export job, as the XML manifest file generally handles this process. The dataset CSV file is more commonly used for other purposes, such as specifying datasets for data analysis or processing.
- Why rejected: This file is not required for the Import/Export service and doesn’t fit the use case for preparing data transfer jobs.
C) A JSON configuration file
- Explanation: JSON configuration files are typically used in Azure for setting up automated services or configurations for services like Azure Functions or ...
Author: Aarav · Last updated Jul 27, 2026
You have a Recovery Service vault that you use to test backups. The test backups contain two protected virtual machines.
You need to del...
To delete a Recovery Services vault in Azure, you must ensure that no items, such as virtual machines (VMs), are still being protected by backup services within the vault. The vault cannot be deleted if it still contains any protected items, and thus, the backup must be disabled or deleted first.
Let's analyze each option:
A) From the Recovery Service vault, delete the backup data
- Explanation: Deleting backup data from the vault would erase the backup data stored in the vault, but this is not sufficient for deleting the vault itself. The vault cannot be deleted until backup is stopped and the protection is unconfigured. Deleting data alone does not stop the backup or remove the protection configuration from the virtual machines.
- Why rejected: This is not the correct first step to delete the vault. You must stop the backup before any data deletion.
B) Modify the disaster recovery properties of each virtual machine
- Explanation: Modifying the disaster recovery properties of the virtual machines (VMs) would typically be necessary for scenarios involving Azure Site Recovery (ASR), not backup. This step is unrelated to stopping backups or deleting the Recovery Services vault.
- Why rejected: This action is not relevant for deleting the Recovery Services vault when using ...
Author: IronLion88 · Last updated Jul 27, 2026
SNAPSHOT -
You have an Azure subscription named Subscription1 that contains the resources shown in the following table.
In storage1, you create a blob container named blob1 and a file share named share1.
Which resources can be backed up to Vault1 and Vault2? To ans...
Author: Layla · Last updated Jul 27, 2026
You have an Azure subscription named Subscription1.
You have 5 TB of data that you need to transfer to Subscription1.
You plan to use an Azure Import/Exp...
To transfer 5 TB of data to Subscription1 using an Azure Import/Export job, the destination must be one that supports the bulk import of data via physical storage (e.g., disk drives) to Azure. The Azure Import/Export service is designed to move large amounts of data into Azure using physical media, typically onto an Azure Storage account, specifically Azure Blob Storage or Azure File Storage.
Let's break down the options:
- A) A virtual machine: Virtual machines in Azure are used for computing purposes, not for bulk data transfer. While you can store data on a virtual machine, a virtual machine is not suitable for the Azure Import/Export job, which focuses on importing data to storage accounts. Additionally, the Import/Export service is not designed to work with VMs directly as destinations. Rejected.
- B) An Azure Cosmos DB database: Azure Cosmos DB is a NoSQL database service for storing and querying unstructured or semi-structured data. It is not designed to be a destination for bulk file imports via the Import/Export service. Importing 5 TB of data into Cosmos DB would require specific database operations, not a bulk import of files. Rejected.
- C) Azure File Storage: Azure File Storage supports the Azur...
Author: David · Last updated Jul 27, 2026
SNAPSHOT -
You have an Azure subscription.
You create the Azure Storage account shown in the following exhibit.
Use the drop-down menus to select the answer choice that completes each statement based on the infor...
Author: Aarav · Last updated Jul 27, 2026
You have an Azure Storage account named storage1.
You plan to use AzCopy to copy data to storage1.
You need to identify the storage services in storage1 to whi...
When using AzCopy to copy data to an Azure Storage account, the tool can work with different types of storage services provided by Azure Storage. The services in an Azure Storage account include Blob Storage, File Storage, Table Storage, and Queue Storage. AzCopy supports specific storage services for data copying operations.
Let's evaluate the options:
- A) blob, file, table, and queue: This option includes all four storage services. However, AzCopy supports Blob Storage and File Storage, but Table Storage and Queue Storage are not directly supported for data transfers using AzCopy. AzCopy cannot be used for copying data into or out of Table or Queue storage. Rejected.
- B) blob and file only: This option is correct. AzCopy can copy data to both Blob Storage and File Storage in Azure. Blob Storage is used for unstructured data (e.g., text, images), and File Storage provides shared file systems using the SMB protocol. These are the two services supported by A...
Author: Andrew · Last updated Jul 27, 2026
SNAPSHOT -
You have an Azure Storage account named storage1 that uses Azure Blob storage and Azure File storage.
You need to use AzCopy to copy data to the blob storage and file storage in storage1.
Which authentication method should you use for each type of storage? To a...
Author: Ella · Last updated Jul 27, 2026
You have an Azure subscription that contains an Azure Storage account.
You plan to create an Azure container instance named container1 that will use a Docker image named Image1. Image1 contains a Microsoft SQL Server instance that requi...
When configuring persistent storage for an Azure Container Instance (ACI) that is running a Docker image containing a Microsoft SQL Server instance, it's important to choose the correct Azure storage service that allows for persistent, file-based data storage, especially since SQL Server requires durable storage for its databases.
Let's evaluate the options:
- A) Azure Files: Azure Files is a fully managed file share in the cloud, providing SMB (Server Message Block) access to data. This storage service is ideal for use cases where you need persistent, file-based storage that can be mounted by container instances. It supports both Linux and Windows containers, and since SQL Server requires persistent file storage for its database files, Azure Files is the best option here. Selected option.
- B) Azure Blob storage: Azure Blob Storage is used for unstructured data like documents, images, and videos, typically accessed through HTTP/S protocols. While Blob Storage can hold SQL Server backup files or log files, it does not natively support persistent file shares for workloads that require a file system interface (like SQL Server databases). SQL Server running in a container typically requires a mounted file system, making...
Author: Nathan · Last updated Jul 27, 2026
You have an app named App1 that runs on two Azure virtual machines named VM1 and VM2.
You plan to implement an Azure Availability Set for App1. The solution must ensure that App1 is available during planned mainte...
In Azure, an Availability Set is a resource grouping that ensures that the virtual machines (VMs) that are part of the set are distributed across different physical servers, networks, and storage to increase the availability and resiliency of your application. Two key components of an Availability Set are fault domains and update domains.
Let’s break down each option:
1. Fault Domains (FD):
- Fault domains define the physical hardware infrastructure within Azure that VMs are distributed across. Each fault domain is essentially a rack of hardware in a datacenter.
- If there’s an issue with the hardware in a fault domain (like a power failure or hardware crash), VMs in that fault domain could go down.
- By having multiple fault domains, you ensure that your VMs are spread across different hardware racks, reducing the likelihood that both VMs will go down during hardware failures.
2. Update Domains (UD):
- Update domains represent logical groupings of VMs that can be rebooted or updated together during planned maintenance.
- Azure ensures that only VMs in a single update domain will be rebooted at the same time during maintenance, so if you have multiple update domains, your app will remain available as other update domains won't be affected by the maintenance.
Now let's analyze the options:
- A) One update domain:
- With only one update domain, both VMs (VM1 and VM2) would be rebooted at the same time during planned maintenance, leading to downtime for your application during the maintenance. This would not meet the requirement to ensure availability during maintenance.
- Rejected...
Author: Grace · Last updated Jul 27, 2026
You have an Azure subscription named Subscription1.
You have 5 TB of data that you need to transfer to Subscription1.
You plan to use an Azure Import/Exp...
The Azure Import/Export service is used to transfer large amounts of data to Azure by physically shipping storage devices (like disks) to an Azure datacenter. The data is then copied from the storage devices to an Azure storage service. To determine the best destination for your imported data, we need to assess the options in the context of Azure Import/Export's supported destinations.
Let's break down the options:
1. A) Azure Cosmos DB database:
- Azure Cosmos DB is a globally distributed NoSQL database service. It is designed to support high throughput, low latency, and scalable applications.
- While you can import data into Cosmos DB via various methods (such as the Azure Data Migration Service or custom scripts), the Azure Import/Export service does not support importing data directly into Cosmos DB.
- Rejected because Azure Import/Export is not compatible with Cosmos DB.
2. B) Azure Blob Storage:
- Azure Blob Storage is an object storage service that is designed to store large amounts of unstructured data, such as text or binary data (e.g., files, images, videos).
- The Azure Import/Export service supports importing data to Azure Blob Storage using the Import/Export Data feature, where physical disks are shipped to an Azure datacenter for copying into a storage account.
- Selected because Azure Blob S...
Author: Scarlett · Last updated Jul 27, 2026
DRAG DROP -
You have an Azure subscription that contains an Azure file share.
You have an on-premises server named Server1 that runs Windows Server 2016.
You plan to set up Azure File Sync between Server1 and the Azure file share.
You need to prepare the subscription for the planned Azure File Sync.
Which two actions should you perform in the Azure subscription? To answer, drag the appropriate actions to the correct targets. Each action m...
Author: Leah Davis · Last updated Jul 27, 2026
SNAPSHOT -
You have an Azure subscription that contains the file shares shown in the following table.
You have the on-premises file shares shown in the following table.
You create an Azure file sync group named Sync1 and perform the following actions:
* Add share1 as the cloud endpoint for Sync1.
* Add data1 as a server endpoint for Sync1.
* Register Server1 and Server2 ...
Author: Krishna · Last updated Jul 27, 2026
SNAPSHOT -
You have an Azure subscription named Subscription1 that contains the resources shown in the following table:
You plan to configure Azure Backup reports for Vault1.
You are configuring the Diagnostics settings for the AzureBackupReports log.
Which storage accounts and which Log Analytics workspaces can you use for the Azure B...
