Your on-premises network contains a VPN gateway.
You have an Azure subscription that contains the resources shown in the following table.
You need to ensure that all the traffic from VM1 to storage1 travels across the Microsoft backbone network.
What should you configure?
A. Azure AD Application Proxy
B. private endpoints
C. a network security group (NSG)
D. Azure Peering Service
Show Answer
Correct Answer: B
Explanation: To ensure traffic from VM1 to storage1 stays on the Microsoft backbone and does not use public endpoints, you must use Azure Private Link with a private endpoint. A private endpoint assigns a private IP address from the virtual network to the storage account, ensuring all traffic flows privately over the Microsoft backbone. The other options do not provide private, backbone-only connectivity to Azure Storage.
Question 73
HOTSPOT -
You have an Azure subscription that contains a storage account named storage1. The storage1 account contains blobs in a container named container1.
You plan to share access to storage1.
You need to generate a shared access signature (SAS). The solution must meet the following requirements:
• Ensure that the SAS can only be used to enumerate and download blobs stored in container1.
• Use the principle of least privilege.
Which three settings should you enable? To answer, select the appropriate settings in the answer area.
Explanation: Container scope allows listing blobs within container1 without broader access. Read permits downloading blob content. List enables enumeration of blobs. This meets least privilege while restricting access to container1 blobs only.
Question 74
HOTSPOT
-
You have an Azure subscription that contains the virtual networks shown in the following table.
Each virtual network has 50 connected virtual machines.
You need to implement Azure Bastion. The solution must meet the fallowing requirements:
• Support host scaling.
• Support uploading and downloading files.
• Support the virtual machines on both VNet1 and VNet2.
• Minimize the number of addresses on the Azure Bastion subnet.
How should you configure Azure Bastion? To answer, select the options in the answer area.
NOTE: Each correct answer is worth one point.
Show Answer
Correct Answer: Subnet size: /26
Public IP: Standard SKU with a static allocation
Explanation: Azure Bastion must use the Standard SKU to support host scaling and file upload/download. Standard SKU also requires a Standard public IP with static allocation. To minimize address usage while still supporting host scaling, the AzureBastionSubnet must be /26 or larger, making /26 the smallest valid choice.
Question 75
HOTSPOT
-
You have an Azure subscription. The subscription contains a storage account named storage1 that has the lifecycle management rules shown in the following table.
On June 1, you store two blobs in storage1 as shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: No
Yes
No
Explanation: File1 (container1): Rule1 moves it to Archive after >3 days, so it is not Cool on June 6.
File2 (container2): On June 7 (>5 days), the rule without a prefix (Rule2) applies and moves it to Cool.
File2: It is deleted after >10 days by Rule3, so it will not be in Archive on June 16.
Question 77
You have an Azure subscription that contains the storage accounts shown in the following table.
Which storage account can be converted to zone-redundant storage (ZRS) replication?
A. storage1
B. storage2
C. storage3
D. storage4
Show Answer
Correct Answer: B
Explanation: Only storage2 meets the requirements for conversion to ZRS. ZRS is supported for Standard general-purpose v2 (StorageV2), Premium BlockBlobStorage, and Premium FileStorage accounts, and the source replication must be LRS (or be converted to LRS first). Among the listed accounts, storage2 matches a supported account kind and replication path, while the others do not.
Question 78
You have an Azure subscription that contains the devices shown in the following table.
On which devices can you install Azure Storage Explorer?
A. Device1 only
B. Device1 and Device2 only
C. Device1 and Device3 only
D. Device1, Device2, and Device3 only
E. Device1, Device3, and Device4 only
Show Answer
Correct Answer: D
Explanation: Azure Storage Explorer is supported on desktop operating systems only: Windows, macOS, and Linux. Based on the devices in the table, Device1, Device2, and Device3 run supported desktop OSs, while Device4 does not. Therefore, Azure Storage Explorer can be installed on Device1, Device2, and Device3.
Question 79
HOTSPOT -
You have an Azure subscription that contains two storage accounts named contoso101 and contoso102.
The subscription contains the virtual machines shown in the following table.
VNet1 has service endpoints configured as shown in the Service endpoints exhibit. (Click the Service endpoints tab.)
The Microsoft.Storage service endpoint has the service endpoint policy shown in the Microsoft.Storage exhibit. (Click the Microsoft.Storage tab.)
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: VM1 can access contoso102: No
VM2 can access contoso101: No
VM2 uses a private IP address to access Azure AD: Yes
Explanation: A service endpoint policy for Microsoft.Storage is applied and allows only contoso101; any other storage account (contoso102) is denied from the subnet using the policy. VM2 is in a subnet without the Storage service endpoint/policy association, so it does not access contoso101 via a service endpoint. The Microsoft.AzureActiveDirectory service endpoint is enabled on Subnet2, so traffic to Azure AD uses the Azure backbone (private routing).
Question 82
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure Active Directory (Azure AD) tenant named contoso.com.
You have a CSV file that contains the names and email addresses of 500 external users.
You need to create a guest user account in contoso.com for each of the 500 external users.
Solution: You create a PowerShell script that runs the New-MgUser cmdlet for each user.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: New-MgUser creates a regular (member) user account in Azure AD, not a guest account. External users must be added by sending an invitation using New-MgInvitation (or New-AzureADMSInvitation), which creates guest users upon acceptance. Therefore, using New-MgUser does not meet the goal.
Question 83
You have an Azure subscription that contains an Azure SQL database named DB1.
You plan to use Azure Monitor to monitor the performance of DB1. You must be able to run queries to analyze log data.
Which destination should you configure in the Diagnostic settings of DB1?
A. Send to a Log Analytics workspace.
B. Archive to a storage account.
C. Stream to an Azure event hub.
Show Answer
Correct Answer: A
Explanation: To run queries and analyze diagnostic log data with Azure Monitor, the logs must be sent to a Log Analytics workspace. Log Analytics supports Kusto Query Language (KQL) for querying and analysis, whereas storage accounts are for archiving and Event Hubs are for streaming to external systems.
Question 84
You have an Azure subscription that contains a storage account named storage1. The storage1 account contains a container named container1.
You need to configure access to container1. The solution must meet the following requirements:
• Only allow read access.
• Allow both HTTP and HTTPS protocols.
• Apply access permissions to all the content in the container.
What should you use?
A. an access policy
B. a shared access signature (SAS)
C. Azure Content Delivery Network (CDN)
D. access keys
Show Answer
Correct Answer: B
Explanation: A Shared Access Signature (SAS) allows you to grant read-only permissions, specify allowed protocols (HTTP and HTTPS), and apply the permissions at the container level so they apply to all blobs within the container. Other options either grant excessive access or do not directly control container-level permissions.
$19
Get all 558 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
