Microsoft Practice Questions, Discussions & Exam Topics by our Authors
SNAPSHOT - You have an Azure App Service web app named app1. You configure autoscaling as shown in following exhibit. You configure the autoscale rule criteria as shown in the following exhibit. Use the drop-down menus to select the answer choice that answ...Author: Vikram · Last updated Jun 25, 2026 |
You have an Azure subscription. You plan to deploy the Azure container instances shown in the following table. ...To answer this question, we need more information about the specific instances (Instance1, Instance2, Instance3, Instance4) and their respective configurations. Typically, when deploying Azure Container Instances (ACI) to a container group, there are key factors that must be considered for the deployment: Key Factors: 1. Operating System: Azure Container Instances support both Linux and Windows containers, but these containers must be compatible with each other in the container group. A container group can have either all Linux containers or all Windows containers. 2. Resource Requirements: Azure Container Instances allow you to define the CPU and memory limits for the container instances. Make sure the container sizes are within the Azure Container Instances limits. 3. Compatibility with Container Group: All instances within a container group must be able to run together, meaning they need to share networking and storage resources, which implies that instances in the same group need to be compatible in terms of platform, architecture, and container requirements. Since the actual details of Instance1, Instance2, Instance3, and Instance4 are not provided in the question, I will explain the possible scenar... Author: Ava · Last updated Jun 25, 2026 |
SNAPSHOT - You have an Azure container registry named contoso2023 as shown in the following exhibit. You need to enable contoso2023 to use a dedicated data endpoint. Which two settings should you configure for contoso2023? To ans...Author: Isabella · Last updated Jun 25, 2026 |
You have an Azure subscription that has the public IP addresses shown in the following table. You plan to deploy an Instance of Azure F...In order to determine which IP addresses can be used for deploying an Azure Firewall Premium (FW1), let's first understand the typical requirements for Azure Firewall and public IP addresses: Key Considerations: 1. Azure Firewall IP Address Requirement: For an Azure Firewall deployment, you need to use public IP addresses to expose the firewall for inbound or outbound traffic. These public IP addresses need to be associated with the firewall, and they must meet certain conditions to be valid for use with the firewall. 2. Azure Firewall Premium Features: Azure Firewall Premium allows for more advanced features like TLS inspection, URL filtering, and more. However, the type of public IP address (static vs dynamic) is a primary concern for deploying the firewall. 3. Static IP Address Requirement: Azure Firewall generally requires static public IP addresses for deployment. Dynamic public IPs cannot be used for a firewall deployment as the IP address might change. Reviewing the Options: A) IP2 only - If IP2 is a static public IP address, it may be a valid option for the Azure Firewall Premium deployment. - Rejection Reason: If any other IP addresses in the list are dynamic or do not meet the static IP requirement, then IP2 only cannot be selected. B) IP1 an... Author: Ming · Last updated Jun 25, 2026 |
SNAPSHOT - You have an Azure subscription. You need to deploy a virtual machine by using an Azure Resource Manager (ARM) template. How should you complete the template? To answer, select the app...Author: John · Last updated Jun 25, 2026 |
SNAPSHOT - You need to configure a new Azure App Service app named WebApp1. The solution must meet the following requirements: * WebApp1 must be able to verify a custom domain name of app.contoso.com. * WebApp1 must be able to automatically scale up to eight instances. * Costs and administrative effort must be minimized. Which pricing plan should you choose, and whic...Author: Lina Zhang · Last updated Jun 25, 2026 |
SNAPSHOT - You have an Azure subscription that contains the virtual machines shown in the following table. You create an Azure Compute Gallery named ComputeGallery1 as shown in the Azure Compute Gallery exhibit. (Click the Azure Compute Gallery tab.) In ComputeGallery1, you create a virtual machine image definition named Image1 as shown in the image definition exhibit. (Click the Imag...Author: Harper · Last updated Jun 25, 2026 |
You plan to create the Azure web apps shown in the following table. What is the minimum number of App S...In order to determine the minimum number of App Service plans needed to create the Azure web apps, it’s important to understand the key factors related to App Service plans and web apps in Azure: Key Considerations: 1. App Service Plan: An App Service Plan defines the region, resources (CPU, memory), and pricing tier for the hosting of your web apps. Each web app needs to be associated with an App Service Plan. 2. Multiple Web Apps in One App Service Plan: You can host multiple web apps within a single App Service Plan if they share the same region and pricing tier. This allows you to optimize resources and costs. 3. Different Pricing Tiers: If different web apps need different pricing tiers or resources, you may need separate App Service plans. For example, an app that requires premium resources might need a different plan from one running on a basic or standard tier. Typical Scenarios: - Same Region, Same Tier: If the web apps are expected to share the same region and pricing tier, you can place them in the same App Service Plan. - Different Tiers or Features: If any of the web apps require a different pricing tier (e.g., one app requires a premium plan and another requires a basic plan), then those apps must reside in different App Service Plans. Without Specific Web App Details: Since the details about the pricing tier, region, or resource requirements of the web apps ... Author: Scarlett · Last updated Jun 25, 2026 |
SNAPSHOT - You have an Azure subscription that contains the resource groups shown in the following table. You create the following Azure Resource Manager (ARM) template named deploy.json. You deploy the template by running the following cmdlet. For each of the follow...Author: Scarlett · Last updated Jun 25, 2026 |
You have an Azure App Service app named App1 that contains two running instances. You have an autoscale rule configured as shown in the following exhibit. For the Instance limits scale condition setting, you set Maximum to 5. During a 30-minute period, App1 use...To determine the maximum number of instances for App1 during the 30-minute period based on the autoscale rule, let's analyze the situation in detail. Key Factors: 1. App Service Scaling: Azure App Service uses autoscaling to automatically adjust the number of running instances based on predefined scale conditions (e.g., CPU, memory usage, or custom metrics). 2. Instance Limits: In this case, the Instance limits scale condition setting defines the maximum number of instances that can be scaled to. You’ve set the maximum to 5. 3. Current Instance Count: The App1 currently has 2 running instances. 4. Memory Usage: During the 30-minute period, App1 uses 80% of the available memory. If memory usage is a part of the autoscale rule and is over a certain threshold (like 80%), it may trigger scaling out (increasing the number of instances). Step-by-Step Reasoning: - Autoscale Trigger: Since App1 is using 80% of memory during the 30-minute period, and the autoscale rule is likely set to scale out when resource usage reaches a certain threshold (e.g., 80%), this would trigger scaling out. - Sc... Author: Ava · Last updated Jun 25, 2026 |
SNAPSHOT - You have an Azure subscription that contains the container images shown in the following table. You plan to use the following services: * Azure Container Instances * Azure Container Apps * Azure App Service In which services can you ...Author: Arjun · Last updated Jun 25, 2026 |
You have an Azure AD tenant named contoso.com. You have an Azure subscription that contains an Azure App Service web app named App1 and an Azure key vault named KV1. KV1 contains a wildcard certificate for contoso.com. You have a user named [email protected] that is assigned the Own...To configure App1 (an Azure App Service web app) to use the wildcard certificate stored in KV1 (Azure Key Vault), the main objective is to grant App1 the proper permissions to access the certificate in KV1. Let's analyze the options and explain which action is needed: Key Considerations: 1. Access Control to Key Vault: Azure Key Vault allows controlling access through access policies or role-based access control (RBAC). App Services (like App1) need permissions to access the certificates or secrets stored in Key Vault. 2. Managed Identity: Azure App Service web apps can use Managed Identity to authenticate with Azure resources like Key Vault without requiring explicit credentials. 3. Access Policy: When using Key Vault, you can define access policies that specify which identities (e.g., App Service) can read the secrets (in this case, the certificate). 4. RBAC vs Access Policies: Access policies are a more direct way to configure access to a Key Vault, whereas RBAC is part of a broader access management system. Review of Options: A) Create an access policy for KV1 and assign the Microsoft Azure App Service principal to the policy. - Explanation: This is the correct approach. You need to create an access policy in KV1 and grant the Azure App Service (via its managed identity) access to the certificate in the Key Vault. The Microsoft Azure App Service principal (which represents the managed identity of the App Service) must be given the Get permission to access the certificate. - Why it is selected: This directly addresses the need to allow App1 (via its managed identity) to access the certificate in KV1. B) Assign a managed user identity to App1. - Explanation: The managed identity for App1 needs to be enabled before it can be granted access to Azure resources like Key Vault. However, this option doesn’t complete the process of granting access to ... Author: Rohan · Last updated Jun 25, 2026 |
You have an Azure subscription. You plan to deploy the resources shown in the following table. You need to create a single Azure Resource Manager (ARM) template that will be used to depl...In an Azure Resource Manager (ARM) template, the dependsOn section is used to specify the order in which resources should be deployed. When you specify a resource in the dependsOn section, it ensures that the referenced resource is deployed before the resource that depends on it. Key Factors: 1. VM1: This is a Virtual Machine (VM) resource that needs to be deployed. A VM typically depends on several resources like the Virtual Network (VNET), Network Interface (NIC), and Public IP (IP), depending on the configuration. 2. VNET1: A Virtual Network (VNET) is usually required by a VM because the VM needs to be connected to a network. The VM must have an available network interface attached to a valid subnet within a VNET. 3. NIC1: A Network Interface (NIC) connects the VM to the VNET. The NIC is required before the VM can be deployed because the VM needs a NIC to be able to communicate over the network. 4. IP1: A Public IP (IP1) may be required if the VM is going to have a public endpoint (e.g., for remote access). However, this depends on whether the VM is configured with a public IP or just an internal one. 5. NSG1: A Network Security Group (NSG) is used to control inbound and outbound traffic to and from resources in the VNET. The NSG can be attached to either the NIC or the subnet, but it's not necessarily a required resource to deploy the VM unless you are configuring specific rules. Analysis of Options: - A) VNET1: The VNET1 is the network to which the VM will be connected. However, the VNET doesn't directly impact the VM deployment ... Author: FrozenWolf2022 · Last updated Jun 25, 2026 |
You have an Azure subscription. You create the following Azure Resource Manager (ARM) template named Template.json. You need to deploy Template.jso...To deploy an Azure Resource Manager (ARM) template named Template.json, we need to choose the correct PowerShell cmdlet based on the target scope and deployment options. Key Factors to Consider: 1. ARM Template Deployment Scope: - New-AzSubscriptionDeployment: This cmdlet is used to deploy ARM templates at the subscription level. It is suitable if you're deploying resources that are scoped to the subscription (like creating resources that aren't tied to any specific resource group). - New-AzManagementGroupDeployment: This cmdlet is used for management group-level deployments. It is used when you are deploying resources across multiple subscriptions or management groups, not typically for a single resource group deployment. - New-AzResourceGroupDeployment: This cmdlet is used for resource group-level deployments. It is the most common cmdlet when you are deploying resources within a specific resource group, which is likely the case in this scenario. - New-AzTetDeployment: This is likely a typo or incorrect option. There is no New-AzTetDeployment cmdlet in Azure PowerShell. Analysis of Options: - A) New-AzSubscriptionDeployment: This is used when you ne... Author: SolarFalcon11 · Last updated Jun 25, 2026 |
You have an Azure subscription that contains a resource group named RG1. You plan to create a storage account named storage1. You have a Bicep file named File1. You need to modify File1 so that it can ...To modify a Bicep file to automate the deployment of a storage account named storage1 to a specific resource group (RG1), you need to ensure that the storage account is configured properly for deployment. The key factor here is determining which property of the storage account resource needs to be set correctly in the Bicep file. Key Considerations for Each Property: 1. kind: This property defines the type of the storage account (e.g., StorageV2, BlobStorage, etc.). While it is important to specify the kind of storage account for the deployment, it is not the primary factor for targeting a specific resource group. It determines the features and capabilities of the storage account but not the scope of deployment. 2. scope: This property defines the deployment scope of the resource, such as the resource group, subscription, or management group. Scope would be used in cases of more advanced deployments, such as targeting multiple resource groups or subscriptions. For a basic storage account deployment within a specific resource group (RG1), the scope does not need to be specified directly within the Bicep file since Bicep assumes the default resource group scope when deploying resources. 3. sku: This property defines the performance and replication options for the storage account, such as Standard_LRS or Premium_ZRS. While the sku is essential for configuring the storage account's performance and replication characteristics, it doesn’t affect the resource group deployment directly. 4. location: This... Author: Joseph · Last updated Jun 25, 2026 |
SNAPSHOT - Your company purchases a new Azure subscription. You create a file named Deploy.json as shown in the following exhibit. You connect to the subscription and run the following cmdlet. New-AzDeployment -Location westus -TemplateFile 'deploy.json' For each of the follo...Author: Ming88 · Last updated Jun 25, 2026 |
You have an Azure subscription that contains the resources shown in the following table. You need to configure a proximity placement group...In order to properly configure a proximity placement group for VMSS1 (Virtual Machine Scale Set), we need to understand how proximity placement groups work in Azure and select the appropriate group(s) based on the proximity requirements. Key Factors to Consider: - Proximity Placement Groups (PPG): A proximity placement group is a logical grouping of Azure resources that are placed close to each other in the same physical location (data center) to reduce latency between them. You can place multiple Azure resources (such as virtual machines, network interfaces, and VMSS) in the same PPG for low-latency communication. - VMSS1: This is a Virtual Machine Scale Set, which is likely to need low-latency connections between its instances. To achieve this, the VMSS should be placed within the same proximity placement group or in a way that optimizes proximity to other critical resources. Explanation of Options: - A) Proximity2 only: The Proximity2 might be one option, but we don't have enough context to confirm if it alone meets the proximity needs of VMSS1. - B) Proximity1, Proximity2, and Proximity3: This option suggests placing VMSS1 in all three proximity placement groups. However, in most Azure scenarios, you would want the resources to ... Author: Lucas · Last updated Jun 25, 2026 |
SNAPSHOT - You have an Azure subscription that contains the virtual networks shown in the following table. The subscription contains the virtual machines shown in the following table. The subscription contains the Azure App Service web apps shown in the following table. For each of th...Author: CrimsonViperX · Last updated Jun 25, 2026 |
You have an Azure subscription named Subscription1 that contains the resources shown in the following table. You create virtual machines in Subscription1 as shown in the following table. You plan to use Vault1 for the b...To determine which virtual machines can be backed up to Vault1, we need to review how Azure Backup works and the relationship between Azure Backup vaults and the resources that can be protected by backups. Key Considerations: 1. Azure Backup Vault: This is a storage location for backup data. The Backup Vault can store backup data from Azure Virtual Machines (VMs). To back up a VM, it must be within the same region as the Backup vault, and it must have the appropriate backup extension or agent installed (e.g., Azure Backup agent or the VM backup extension). 2. VMs in the Same Subscription and Region: Typically, Azure Backup supports backing up VMs that are in the same region and same subscription as the Backup vault. If the Backup vault is located in a different region, the VMs should also be in that region, or a cross-region backup might need to be configured, but this scenario isn't common for regular Azure Backup setups. 3. VM1, VM2, VM3, VMA, VMB, VMC: We need to identify the region and subscription of each virtual machine relative to the Backup vault to decide which can be backed up. Analysis of Options: - A) VM1 only: If VM1 is the only virtual machine located in the same region as Vault1, then only VM1 could be backed up. This might... Author: Rohan · Last updated Jun 25, 2026 |
You have an Azure subscription that contains an Azure container registry named ContReg1. You enable the Admin user for ContReg...When you enable the Admin user for an Azure Container Registry (ACR), this action creates an admin user that can be used to authenticate and access the registry. The admin user is a built-in service principal with access to the Azure container registry. Key Factors: 1. Admin User for Azure Container Registry: When you enable the Admin user for ACR, it provides you with a default username (not the Azure subscription admin). This username is typically "admin". The admin account allows you to access the registry without needing additional service principals or Azure Active Directory-based identities for authentication. 2. Username Options: - A) root: The root username is not used for authenticating into an Azure Container Registry. It is generally associated with root users for operating system access or other legacy systems, not for Azure services. - B) admin: The admin username is the correct default username created when you enable the Admin user for the Azure Container ... Author: FrostFalcon88 · Last updated Jun 25, 2026 |
You have an Azure subscription. You plan to create an Azure container registry named ContReg1. You need to ensure that you can push and pull ...To ensure that you can push and pull signed images for the Azure Container Registry (ACR) named ContReg1, the correct option is D) Enable content trust. Explanation of the options: 1. A) Enable encryption by using a customer-managed key: - Encryption with a customer-managed key is used to control the encryption of your ACR's data at rest, providing an additional layer of security. However, it is not related to signing or verifying container images for push and pull operations. This option is useful when you want to manage the encryption keys but does not affect image signing. - Rejected: Does not address signing or ensuring the integrity of pushed/pulled images. 2. B) Create a connected registry: - Connected registry refers to linking your Azure Container Registry to an external registry (such as Docker Hub or another registry) for interoperability. While it facilitates integration with other container registries, it doesn't d... Author: Emma Brown · Last updated Jun 25, 2026 |
SNAPSHOT - You have an Azure subscription that has the Azure container registries shown in the following table. You plan to use ACR Tasks and configure private endpoint connections. Which container registries support ACR Tasks and private endpoints?...Author: Amelia · Last updated Jun 25, 2026 |
You plan to deploy several Azure virtual machines that will run Windows Server 2022 in a virtual machine scale set by using an Azure Resource Manager template. You need to ensure that NGINX is a...To ensure that NGINX is available on all the virtual machines after they are deployed in an Azure Virtual Machine Scale Set (VMSS) running Windows Server 2022, the correct option is A) Azure Custom Script Extension. Explanation of the options: 1. A) Azure Custom Script Extension: - Azure Custom Script Extension is specifically designed to run custom scripts on Azure virtual machines after they are deployed. You can use it to install software, configure settings, or perform other post-deployment tasks. In this case, you can use a custom script to install NGINX on each virtual machine in the scale set. - Selected: This is the most appropriate option because it allows you to automate the installation and configuration of NGINX across all virtual machines in the VMSS. 2. B) Deployment Center in Azure App Service: - Deployment Center in Azure App Service is primarily used for deploying applications to Azure App Services, not virtual machines. It supports deployment from source control or containers but is not applicable to virtual machines or scale sets. - Rejected: It’s not intended for managing deployments on Azure virtual machines and cannot be used to inst... Author: MysticJaguar44 · Last updated Jun 25, 2026 |
You have an Azure subscription that contains a container group named Group1. Group1 contains two Azure container instances as shown in the following table. You need to ensure that container2 ...To ensure that container2 can use CPU resources without negatively affecting container1 in Group1, the correct option is D) Decrease the resource limit of container2 to two CPUs. Explanation of the options: 1. A) Increase the resource limit of container1 to three CPUs: - Increasing the CPU limit for container1 might improve its performance, but it may not address the concern of container2 consuming too many resources and potentially starving container1. The problem lies in managing the resources effectively between the two containers to avoid resource contention, and this option could actually make the situation worse if container2 doesn't get enough resources. - Rejected: It doesn't solve the problem of managing resources for both containers effectively. 2. B) Increase the resource limit of container2 to six CPUs: - Increasing container2's CPU resource limit to six CPUs may make it consume more CPU resources, which could still cause it to negatively affect container1 if there are not enough available resources. Increasing the resource limit for container2 might exacerbate the resource contention problem between the two containers. - Rejected: This option would likely make the problem worse... Author: Aria · Last updated Jun 25, 2026 |
You have an Azure subscription. You plan to deploy a container. You need to recommend which Azure services can scale the...To recommend Azure services that can scale a container automatically, the correct option is A) Azure Container Apps only. Explanation of the options: 1. A) Azure Container Apps only: - Azure Container Apps is a fully managed service designed to deploy and scale containers based on demand. It has built-in support for auto-scaling based on CPU, memory usage, and custom metrics, making it a perfect choice for automatically scaling containers. - Selected: Azure Container Apps is explicitly designed for automatically scaling containers based on workload demand, making it the best choice for this scenario. 2. B) Azure Container Instances only: - Azure Container Instances (ACI) allows for running containers without managing the underlying infrastructure, but it does not natively support auto-scaling. You would need to manually manage scaling, such as scaling up or down container instances through automation (like Azure Logic Apps or Azure Automation). - Rejected: ACI does not offer native auto-scaling for containers, so it's not ideal for scenarios that require automatic scaling. 3. C) Azure Container Apps or Azure App Service only: - Azure App Service also allows the deployment of containers and supports auto-scaling, but it is more tailored toward web applications... Author: Olivia · Last updated Jun 25, 2026 |
SNAPSHOT - You have an Azure subscription that uses Azure Container Instances. You have a computer that has Azure Command-Line Interface (CLI) and Docker installed. You create a container image named image1. You need to provision a new Azure container registry and add image1 to the registry. Which comma...Author: Ella · Last updated Jun 25, 2026 |
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure container registry named Registry1 that contains an image named image1. You receive an error message...The correct answer is B) No. Explanation: In this scenario, you're trying to deploy a container instance using an image stored in Registry1, but you receive an error message during the deployment process. The solution provided is to assign the AcrPull role to ACR-Tasks-Network for Registry1. Key reasoning behind the selection: - AcrPull role: This role provides the ability to pull (read) container images from Azure Container Registry (ACR). The AcrPull role is typically assigned to users, applications, or services that need to access the container registry to pull images. - ACR-Tasks-Network: This is a service principal used for ACR tasks, and assigning the AcrPull role to this service principal will allow it to pull images. However, this solution is not the correct approach for the deployment scenario you're describing. Why this does not meet the goal: - The AcrPull role is typically used for allowing a service (like a container instance or a VM) to pull an image from the registry. However, if you're experiencing an issue during the deployment of the container instance, it’s likely related to the service principal or managed identity th... Author: Sofia · Last updated Jun 25, 2026 |
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure container registry named Registry1 that contains an image named image1. You receive an error ...The correct answer is B) No. Explanation: In this scenario, you're attempting to deploy a container instance using image1 from Registry1, but you encounter an error message. The proposed solution is to select Use dedicated data endpoint for Registry1. Key reasoning behind the selection: - Dedicated Data Endpoint: Selecting a dedicated data endpoint is an option in Azure Container Registry (ACR), which allows you to isolate data traffic between Azure services and the container registry. When enabled, the registry will use a specific endpoint for accessing the registry data, which could improve network performance and security. - Dedicated Data Endpoint does not directly address the issue of deploying a container from a registry. This feature is related to network configuration for access and does not affect the permissions or the ability of a container instance to pull images from the registry. Why this does not meet the goal: - The error you're receiving when trying to deploy the container is more likely related to authentication or permission issues (such as the AcrPull role not being assigne... Author: Aarav · Last updated Jun 25, 2026 |
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure container registry named Registry1 that contains an image named image1. You receive an error m...The correct answer is A) Yes. Explanation: In this scenario, you are attempting to deploy a container instance using image1 from Registry1, but you encounter an error message. The proposed solution is to create a private endpoint connection for Registry1. Key reasoning behind the selection: - Private Endpoint: A private endpoint is a network interface that connects you privately and securely to a service, such as an Azure Container Registry (ACR), over a private link. When you create a private endpoint for Registry1, the registry can be accessed securely from your container instance over a private IP address in a virtual network (VNet), rather than a public IP. - If the Registry1 is behind a private endpoint (or using private link), this ensures that access to the registry from your container instance is done securely within the network, without traversing the public internet. This can be particularly useful when there are firewall rules, network restrictions, or when you're trying to avoid public access to your ACR. ... Author: Scarlett · Last updated Jun 25, 2026 |
You have a Standard Azure App Service plan named Plan1. You need to ensure that Plan1 will scale automatically when the CPU usage of the we...The correct answer is B) Rules Based in the Scale out method settings. Explanation: In this scenario, you're trying to set up auto-scaling for your Azure App Service plan (Plan1) to scale when the CPU usage exceeds 80 percent. The solution requires enabling auto-scaling based on a specific condition (CPU usage). Key reasoning behind the selection: - Rules Based in the Scale out method settings: - This option allows you to define custom scaling rules for your Azure App Service plan. Using rules-based scaling, you can configure the scaling to trigger based on specific conditions, such as CPU usage exceeding 80 percent. - You can define rules that monitor metrics (such as CPU utilization) and automatically scale the service up or out depending on these metrics. This would ensure your app scales dynamically when CPU usage exceeds the set threshold (80% in this case). Selected: This is the appropriate option because it directly supports scaling based on conditions such as CPU utilization. Why other options are rejected: 1. A) Automatic in the Scale out method settings: - The Automatic option in the scaling settings typically refers to auto-scaling without custom rules or conditions. It doesn't allow you to set specific thresholds like CPU usage. While it enables scaling, it does not give you the flexibility to scale based on specific metrics or conditions (e.g., CPU usa... Author: Emma Brown · Last updated Jun 25, 2026 |
Case study - This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided. To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study. At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new section, you cannot return to this section. To start the case study - To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the subse...To determine the appropriate certificate to use for configuring WebApp1 to meet the technical requirements, let's go through the reasoning process based on the provided information. Key Considerations: 1. TLS Requirement: The configuration must use TLS for WebApp1. TLS (Transport Layer Security) requires a valid SSL/TLS certificate to secure communications between WebApp1 and its clients. 2. Certificate Source: The certificate must be chosen from the Azure Key Vault, Vault1, which contains several certificates. 3. Compatibility: Certificates need to meet the necessary criteria for securing web applications with TLS, which typically involves using a certificate that is valid for server authentication (e.g., SSL certificates). Information on Certificates in Vault1: - Cert1, Cert2, Cert3, Cert4 are stored in Vault1, but we need more details about their properties (such as their purpose and validity period). Without specific attributes mentioned in the case study, we assume that: - Cert1 could be used for server authentication. - Cert2 might also be a valid SSL/TLS certificate. - Cert3 and Cert4 could be used for other purposes, like ... Author: Ethan · Last updated Jun 25, 2026 |
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure virtual machine named VM1. VM1 was deployed by using a custom Azure Resource Manager template named AR...Let's analyze the scenario and evaluate whether the proposed solution meets the goal of moving VM1 to a different host immediately. Scenario Overview: - VM1: An Azure virtual machine deployed using a custom Azure Resource Manager (ARM) template (`ARM1.json`). - Goal: You need to move VM1 to a different host immediately because of maintenance. Proposed Solution: - Solution: "From the resource group blade, move VM1 to another subscription." Key Considerations: 1. Moving VM1: The act of moving a virtual machine in Azure generally refers to transferring it between different resource groups or subscriptions. This can be done through the Azure portal, and it's typically done for organizational purposes or to manage resources better. 2. Affect of Maintenance: The notification about VM1 being affected by maintenance suggests that you need to move the VM to another host. Azure provides a feature called "move" to transfer resources between subscriptions or resource groups. However, moving a VM to a different subscription or resource group does not ne... Author: William · Last updated Jun 25, 2026 |
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure virtual machine named VM1. VM1 was deployed by using a custom Azure Resource Manager template named ...Let's analyze whether the proposed solution meets the goal of moving VM1 to a different host immediately. Scenario Overview: - VM1: An Azure virtual machine deployed using a custom ARM template (`ARM1.json`). - Goal: You need to move VM1 to a different host immediately to avoid maintenance. Proposed Solution: - Solution: "From the VM1 Redeploy + reapply blade, you select Redeploy." Key Considerations: 1. Redeploying a VM: - The Redeploy option in Azure allows you to move a VM to a different physical host. This process is often used when a VM is affected by maintenance, as it reinitiates the VM and places it on a different host. - This is a specific feature designed to help mitigate issues arising from planned maintenance or host failures by moving the VM to a new underlying physical server. - When you select Redeploy, Azure will stop and r... Author: Nia · Last updated Jun 25, 2026 |
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure virtual machine named VM1. VM1 was deployed by using a custom Azure Resource Manager template n...To answer the question correctly, let’s break down the key elements involved: Scenario Overview: - You have a VM (VM1) deployed using a custom ARM template (ARM1.json). - VM1 will be affected by maintenance and you need to move it to a different host immediately. Solution Review: - One-time update from the VM1 Updates blade: The One-time update option applies to scenarios where updates are available, and the virtual machine can be updated to resolve issues like critical patches or vulnerabilities. However, this option does not move the VM to another host immediately. Instead, it applies updates to the VM. This action is typically used to update the operating system or other software on the VM, not t... Author: Akash · Last updated Jun 25, 2026 |
Case study - This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided. To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study. At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new section, you cannot return to this section. To start the case study - To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the subse...To determine the correct PowerShell cmdlet and key to use for Azure Disk Encryption (ADE) and the Key Encryption Key (KEK), let's analyze the scenario and the requirements. Scenario Overview: - Azure Disk Encryption: The requirement is to use Azure Disk Encryption with a Key Encryption Key (KEK) to encrypt the virtual machines. - Key Vault: Vault1 contains keys (Key1 and Key2), and the correct key must be selected for the disk encryption process. Key Considerations: 1. Azure Disk Encryption: To enable Azure Disk Encryption with a KEK, the cmdlet typically used is Set-AzVMDiskEncryptionExtension. This cmdlet is designed to configure disk encryption on a virtual machine and allows specifying the encryption key and the Key Vault from which the key is retrieved. 2. Key Selection: - Key1: This key is likely the Key Encryption Key (KEK) that would be used for encrypting the virtual machine’s disks. Based on the scenario, the goal is to use a KEK for disk encryption. - Key2: If this... Author: Madison · Last updated Jun 25, 2026 |
SNAPSHOT - You have an Azure subscription named Sub1. You plan to deploy a multi-tiered application that will contain the tiers shown in the following table. You need to recommend a networking solution to meet the following requirements: * Ensure that communication between the web servers and the business logic tier spreads equally across the virtual machines. * Protect the web servers from SQL injection attacks. W...Author: Noah Williams · Last updated Jun 25, 2026 |
Your company has three offices. The offices are located in Miami, Los Angeles, and New York. Each office contains datacenter. You have an Azure subscription that contains resources in the East US and West US Azure regions. Each region contains a virtual network. The virtual networks are peered. You need to co...To connect the three datacenters (Miami, Los Angeles, and New York) to the Azure subscription with minimal network latency, we need to consider the most efficient and scalable method to interconnect the datacenters and the Azure resources. Key Considerations: 1. Network Latency Minimization: Minimizing latency requires a solution that efficiently handles traffic between on-premises datacenters and Azure while leveraging Azure's networking capabilities. The solution should optimize routing between multiple locations (offices in different regions). 2. Azure Regions and Virtual Networks: You have Azure resources in the East US and West US regions. The virtual networks in these regions are peered. These networks must be connected to the datacenters, and traffic must be routed efficiently between them. 3. Solution Requirements: - Minimizing Latency: Using a solution that facilitates high-throughput and low-latency connectivity between multiple regions and on-premises resources. - Datacenter Connections: The datacenters must be connected to the Azure virtual networks in a scalable and efficient manner. Option Analysis: - A) Three Azure Application Gateways and One On-premises Data Gateway: - Azure Application Gateway: An Application Gateway is a layer 7 load balancer used primarily for web traffic (HTTP/HTTPS) to provide application delivery features such as SSL termination, URL-based routing, and web application firewall capabilities. - On-premises Data Gateway: Typically used for hybrid connectivity, such as linking on-premises data sources to Azure services. - Why Rejected: This solution is focused more on application delivery and hybrid data integration. It does not focus on minimizing network latency or creating optimized connections between datacenters and Azure resources. - B) Three Virtual Hubs and... Author: GlowingTiger · Last updated Jun 25, 2026 |
SNAPSHOT - You plan to deploy five virtual machines to a virtual network subnet. Each virtual machine will have a public IP address and a private IP address. Each virtual machine requires the same inbound and outbound security rules. What is the minimum number of network interfaces and network security groups tha...Author: Madison · Last updated Jun 25, 2026 |
You have an Azure subscription that contains the resources shown in the following table. LB1 is configured as shown in the following table. You plan to create new inbound NAT rules that meet the following requirements: * Provide Remote Desktop access to VM1 from the internet by using port 3389. * Provide Remote...To create the inbound NAT rules for Remote Desktop access to VM1 and VM2 from the internet on port 3389 using LB1, we need to understand the necessary prerequisites for configuring inbound NAT rules in Azure Load Balancer (LB). Key Considerations: 1. Inbound NAT Rules: - Inbound NAT (Network Address Translation) rules allow external clients to connect to specific internal virtual machines (VMs) in a load-balanced pool, typically for administrative access such as Remote Desktop (RDP) on port 3389. - Before creating these NAT rules, the Load Balancer needs to be properly configured with specific components such as a frontend IP address, backend pool, and health probes. 2. What LB1 Needs for NAT Rules: - Frontend IP Address: This is the public IP address on the Load Balancer that the internet will use to connect to the internal VMs (VM1 and VM2). It serves as the entry point for inbound traffic, such as RDP on port 3389. - Backend Pool: The backend pool consists of the internal VMs that will receive traffic after NAT is applied. These VMs need to be added to the backend pool for the NAT rules to direct traffic to them. - Load Balancing Rules: These are used for load balancing traffic, but for NAT rules specifically, they are not directly relevant. - Health Probe: Health probes are typically used in a load balancing scenario to monitor the health of backend VMs. However, they are not required when configuring inbound NAT rules for specific ports like RDP. Explanation of Options: - A) A frontend IP address: - Selected Option... Author: Suresh · Last updated Jun 25, 2026 |
SNAPSHOT - You have Azure virtual machines that run Windows Server 2019 and are configured as shown in the following table. You create a private Azure DNS zone named adatum.com. You configure the adatum.com zone to allow auto registration from VNET1. Which A records will be added to the adatum.com zone for each v...Author: Zara · Last updated Jun 25, 2026 |
SNAPSHOT - You have an Azure virtual network named VNet1 that connects to your on-premises network by using a site-to-site VPN. VNet1 contains one subnet named Sunet1. Subnet1 is associated to a network security group (NSG) named NSG1. Subnet1 contains a basic internal load balancer named ILB1. ILB1 has three Azure virtual machines in the backend pool. You need to collect data about the IP addresses that connects to ILB1. You must be able to run interactive ...Author: ThunderBear · Last updated Jun 25, 2026 |
You have the Azure virtual networks shown in the following table. To which virtual networks can yo...To answer this question, let's go step-by-step through the key factors: Key Concepts of VNet Peering: - VNet Peering allows two virtual networks (VNets) to communicate with each other as if they were part of the same network. For peering to occur, the following conditions must be met: 1. Regional restrictions: VNets that can be peered must either be in the same region or be in different regions (using global peering). 2. Address Space: The address spaces of the VNets should not overlap. Overlapping address spaces would prevent peering. 3. VNet Peering Permissions: The required permissions need to be in place on both VNets. Assumptions about the Scenario: - The question doesn’t explicitly provide details about whether the VNets are in the same region, their address spaces, or the permissions set up, but these are all crucial factors to determine whether VNet peering is possible. Based on the question’s phrasing, we need to infer that the selected virtual networks are compatible for peering under typical conditions. We will evaluate each option based on common cases and the scenario setup. Option Analysis: - Option A (VNet2 and VNet3 only): This suggests that only these two VNets can be peered with VNet1. This could be the case if VNet1's address space doesn’t overlap with VNet2 or VNet3, and they’re either... Author: Emma Brown · Last updated Jun 25, 2026 |
You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains four subnets named Gateway, Perimeter, NVA, and Production. The NVA subnet contains two network virtual appliances (NVAs) that will perform network traffic inspection between the Perimeter subnet and the Production subnet. You need to implement an Azure load balancer for the NVAs. The solution must meet the following requirements: * The NVAs must run in an active-active configuration that uses automatic failover. * The load balancer must load bala...To meet the requirements of this scenario, let’s break down the critical factors involved: Key Requirements: 1. Active-active configuration with automatic failover: This implies that the Azure load balancer should be set up to handle traffic distribution in an active-active mode for the two NVAs and ensure that if one NVA fails, the other will automatically take over without service disruption. 2. Load balancing traffic to two services with different IP addresses: The load balancer needs to distribute traffic between two services located on the Production subnet, each with a different IP address. 3. Network traffic inspection by NVAs: The NVAs are responsible for inspecting traffic between the Perimeter and Production subnets, which means the load balancer should ensure proper traffic flow through the NVAs for inspection. Evaluation of Options: Option A: Deploy a basic load balancer - Why it’s rejected: A Basic Load Balancer cannot meet the active-active configuration requirement. It does not support automatic failover between multiple instances and is not designed for high availability or for use with multiple backend pools. - Why not selected: Basic load balancers are not designed for advanced configurations, such as active-active mode and automatic failover. Option B: Deploy a standard load balancer - Why it’s selected: A Standard Load Balancer supports advanced configurations, including high availability, automatic failover, and active-active mode. It also allows you to load balance traffic across multiple instances of a service. This meets the requirement of having the NVAs run in an active-active configuration and ensures failover functionality if one NVA fails. - Why selected: The Standard Load Balancer supports all the necessary features for this scenario, including advanced load balancing features and high availability. Option C: Add two load balancing rules that have HA Ports and Floating IP enabled - Why it’s selected: HA Ports (High Availability Ports) are necessary for active-active configurations because they allow both NVAs to handle traffic without interrupting connectivity. Floating IP allows the IP to float between the backend pool members (NVAs) in the active-active configuration. This ensures that traffic can be forwarded correctly even if one of the NVAs fails. - Why selected: The combinatio... Author: Maya2022 · Last updated Jun 25, 2026 |
You have an Azure subscription named Subscription1 that contains two Azure virtual networks named VNet1 and VNet2. VNet1 contains a VPN gateway named VPNGW1 that uses static routing. There is a site-to-site VPN connection between your on-premises network and VNet1. On a computer named Client1 that runs Windows 10, you configure a point-to-site VPN connection to VNet1. You configure virtual network peering between VNet1 and VNet2. Y...To solve this problem, let's analyze the key factors involved and what each action option entails: Scenario Breakdown: - You have a site-to-site VPN connection between your on-premises network and VNet1. - A point-to-site VPN connection from Client1 (a Windows 10 machine) is configured to connect to VNet1. - Virtual network peering exists between VNet1 and VNet2, and it's verified that the on-premises network can connect to VNet2. - Client1, however, is unable to connect to VNet2 even though the on-premises network can. Key Concepts: - Virtual Network Peering: When VNets are peered, by default, traffic can flow between them, but certain settings need to be configured to enable or allow the use of a VPN Gateway for traffic routing between VNets. - VPN Gateway Transit: This setting allows one VNet (in this case, VNet1) to transit traffic through its VPN gateway to another VNet (like VNet2). This is important for ensuring that point-to-site VPN clients connected to VNet1 can route traffic to VNet2. - BGP (Border Gateway Protocol): BGP is used to dynamically exchange routing information between the VPN gateway and on-premises network. This wouldn't directly address the inability of Client1 to connect to VNet2, especially if routing is already set up correctly. Option Analysis: - Option A: Download and re-install the VPN client configuration package on Client1: - This would typically be useful if there was a client-side configuration issue or corruption, but it's unlikely to resolve the specific issue of routing traffic between VNet1 and VNet2 through the VPN gateway. The problem is not related to the client configuration but to how routing and transit are set up between VNets. - Rejected: This option does not address the core issue of routing between VNets. - Option B: Select Allo... Author: Oliver · Last updated Jun 25, 2026 |
SNAPSHOT - You have an Azure subscription. The subscription contains virtual machines that run Windows Server 2016 and are configured as shown in the following table. You create a public Azure DNS zone named adatum.com and a private Azure DNS zone named contoso.com. You create a virtual network link for contoso.com as shown in the following exhibit. F...Author: Isabella · Last updated Jun 25, 2026 |
You have an Azure subscription that contains the resources in the following table. To which subne...To determine to which subnets NSG1 can be applied, we must consider the following key factors: 1. NSGs (Network Security Groups) can only be applied to subnets within the same Virtual Network (VNet). 2. NSGs are either applied to the subnet or the individual network interface cards (NICs) of VMs within a VNet. 3. Different VNets are isolated from each other, meaning that an NSG applied to a subnet in one VNet cannot affect resources in a different VNet. Let's break down each option: - Option A: The subnets on VNet1 only This option suggests applying the NSG only to subnets within VNet1. If NSG1 is specifically assigned to VNet1 and all subnets are part of VNet1, then this is a valid choice. - Option B: The subnets on VNet2 and VNet3 only This option suggests applying NSG1 to subnets in VNet2 and VNet3. However, an NSG can only be applied to subnets within a specific VNet. Since VNets are isolated from each other, it is not possible to apply the same NSG across multiple VNets (unless they are connected via peering or other advanced networking configurations, but by default this would be rejected). - Option C: The subnets on VNet2 only Similar... Author: Emma Brown · Last updated Jun 25, 2026 |
DRAG DROP - You have an Azure subscription that contains two virtual networks named VNet1 and VNet2. Virtual machines connect to the virtual networks. The virtual networks have the address spaces and the subnets configured as shown in the following table. You need to add the address space of 10.33.0.0/16 to VNet1. The solution must ensure that the hosts on VNet1 and VNet2 can communicate. Which three act...Author: Evelyn · Last updated Jun 25, 2026 |
SNAPSHOT - You have an Azure subscription that contains the resource groups shown in the following table. RG1 contains the resources shown in the following table. VM1 is running and connects to NIC1 and Disk1. NIC1 connects to VNET1. RG2 contains a public IP address named IP2 that is in the East US location. IP2 is not assigned to a virtual machine. F...Author: Ethan Smith · Last updated Jun 25, 2026 |
You have an Azure web app named webapp1. You have a virtual network named VNET1 and an Azure virtual machine named VM1 that hosts a MySQL database. VM1 connects to VNET1. You need ...To ensure that webapp1 (an Azure web app) can access the data hosted on VM1 (which is running a MySQL database on a virtual machine within VNET1), we need to carefully consider how Azure networking and connectivity work in this context. Below are the key factors for each option: Key Considerations: 1. Azure Web Apps (webapp1): By default, Azure web apps are hosted in a multi-tenant environment and are not part of your VNet unless specifically configured. Web apps do not have direct access to resources inside a VNet unless configured properly. 2. VM1 and VNET1: VM1 is hosted inside VNET1 and can access resources within that VNet. If webapp1 needs to access VM1 (which is inside VNET1), the web app should be able to communicate with VNET1. Let's break down the options: - Option A: Deploy an internal load balancer - An internal load balancer is used for distributing traffic within a VNet (usually for internal resources only). This solution does not address the need for webapp1 to access resources in VNET1 directly. A load balancer itself does not solve the challenge of connecting webapp1 (which is external to VNET1) to the resources in VNET1. - Rejected: This option does not solve the core problem of connectivity between webapp1 and VM1. - Option B: Peer VNET1 to another virtual network - Peering VNET1 with another VNet could be useful if you have two different VNets that need to communicate with eac... Author: Elijah · Last updated Jun 25, 2026 |
You create an Azure VM named VM1 that runs Windows Server 2019. VM1 is configured as shown in the exhibit. (Click the Exhibit tab.) You need to enab...To enable Desired State Configuration (DSC) for VM1, we must consider the following steps, which are part of the preparation for using DSC in a Windows environment: Key Considerations: 1. Desired State Configuration (DSC) is a management framework in Windows that allows you to define and ensure the desired state of a system's configuration. To enable DSC, the system must be running and accessible. 2. The initial step when setting up DSC generally involves ensuring that the VM is operational and that you can access it for configuration. Let's break down the options: - Option A: Connect to VM1 This is the most logical first step. To enable and configure DSC, you must connect to VM1 either via Remote Desktop Protocol (RDP) or PowerShell Remoting. DSC configurations are typically applied after you have accessed the machine and validated its current configuration. - Selected: You need to connect to the VM first to ensure you can configure it, either through PowerShell or other DSC management tools. - Option B: Start VM1 If VM1 is already running, you do not need to start it again. The need to start the VM would only apply if the VM was in a stopped state, but since the question doesn't mention VM1 being sto... Author: StarlightBear · Last updated Jun 25, 2026 |