You have an Azure subscription that contains the storage accounts shown in the following table.
You deploy a web app named App1 to the West US Azure region.
You need to back up App1. The solution must minimize costs.
Which storage account should you use as the target for the backup?
A. storage1
B. storage2
C. storage3
D. storage4
Show Answer
Correct Answer: B
Explanation: Use storage2. It is a blob storage account in West US, the same region as App1, and avoids the higher cost of the premium BlockBlobStorage account (storage3). The other accounts are in different regions or are intended for Azure Files.
Question 48
You have an Azure AD tenant named adatum.com that contains the groups shown in the following table.
Adatum.com contains the users shown in the following table.
You assign the Azure Active Directory Premium Plan 2 license to Group1 and User4.
Which users are assigned the Azure Active Directory Premium Plan 2 license?
A. User4 only
B. User1 and User4 only
C. User1, User2, and User4 only
D. User1, User2, User3, and User4
Show Answer
Correct Answer: B
Explanation: Group1-based licensing applies to its direct user member, User1. Group2 and Group3 are nested groups, so their users (User2 and User3) do not receive the license through Group1. User4 receives the license directly. Therefore, User1 and User4 are licensed.
Question 48
HOTSPOT -
You have an Azure subscription named Subscription1.
In Subscription1, you create an Azure file share named share1.
You create a shared access signature (SAS) named SAS1 as shown in the following exhibit:
To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: 1. Will have no access
2. Will have no access
Explanation: The first computer’s IP address is outside the SAS’s allowed range (193.77.134.10–193.77.134.50). The second IP is allowed, but `net use` connects over SMB, which does not accept a SAS as the password.
Question 49
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure subscription named Subscription1 that contains the resources shown in the following table.
Subscription1 also includes a virtual network named VNET2. VM1 connects to a virtual network named VNET2 by using a network interface named NIC1.
You need to create a new network interface named NIC2 for VM1.
Solution: You create NIC2 in RG2 and West US.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: A
Explanation: Yes. NIC2 must be in the same Azure region as VM1 and the virtual network it connects to. West US satisfies that requirement. A resource group’s location does not restrict the locations of resources it contains, so NIC2 can be in RG2 even though RG2 is located in West Europe.
Question 49
HOTSPOT -
You have an Azure virtual machine that runs Windows Server 2019 and has the following configurations:
✑ Name: VM1
✑ Location: West US
✑ Connected to: VNET1
✑ Private IP address: 10.1.0.4
✑ Public IP addresses: 52.186.85.63
✑ DNS suffix in Windows Server: Adatum.com
You create the Azure DNS zones shown in the following table.
You need to identify which DNS zones you can link to VNET1 and the DNS zones to which VM1 can automatically register.
Which zones should you identify? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: DNS zones that you can link to VNET1: The private zones only
DNS zones to which VM1 can automatically register: The private zones only
Explanation: Virtual network links and VM auto-registration are features of Azure Private DNS zones, regardless of the zone’s region. Auto-registration must be enabled on the link; VM1’s Windows DNS suffix does not enable registration in a public zone.
Question 49
HOTSPOT -
You have an Azure subscription that contains the virtual networks shown in the following table.
You have the peering options shown in the following exhibit.
You need to design a communication strategy for the resources on the virtual networks.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Peering 1-2: No
Peering 1-3: No
Peering 3-2: No
Explanation: VNet peering is supported within the same Azure cloud environment. Azure Public, Azure Government, and Azure China are separate cloud environments, so peering between them is not supported.
Question 50
You have an Azure subscription that contains a storage account named storage1.
You have the devices shown in the following table.
From which devices can you use AzCopy to copy data to storage1?
A. Device 1 only
B. Device1, Device2 and Device3
C. Device1 and Device2 only
D. Device1 and Device3 only
Show Answer
Correct Answer: B
Explanation: AzCopy is available for Windows, Linux, and macOS, so you can use it from all three devices to copy data to storage1.
Question 51
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure Storage account named storage1.
You need to enable a user named User1 to list and regenerate storage account keys for storage1.
Solution: You assign the Reader and Data Access role to User1.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: The Reader and Data Access role provides read access to storage account metadata and data-plane access information but does not grant permission to regenerate storage account access keys. Listing and regenerating storage account keys requires a role that includes the Microsoft.Storage/storageAccounts/listKeys/action and regenerateKey/action permissions, such as the Storage Account Key Operator Service Role (or a broader role like Owner/Contributor).
Question 51
You develop the following Azure Resource Manager (ARM) template to create a resource group and deploy an Azure Storage account to the resource group.
Which cmdlet should you run to deploy the template?
A. New-AzResource
B. New-AzResourceGroupDeployment
C. New-AzTenantDeployment
D. New-AzDeployment
Show Answer
Correct Answer: D
Explanation: The template creates a resource group and includes a nested deployment into it, so it must be deployed at subscription scope. Use **New-AzDeployment**. **New-AzResourceGroupDeployment** deploys to a resource group that already exists.
Question 51
HOTSPOT -
You have an Azure virtual network named VNet1 that connects to your on-premises network by using a site-to-site VPN. VNet1 contains one subnet named
Sunet1.
Subnet1 is associated to a network security group (NSG) named NSG1. Subnet1 contains a basic internal load balancer named ILB1. ILB1 has three Azure virtual machines in the backend pool.
You need to collect data about the IP addresses that connects to ILB1. You must be able to run interactive queries from the Azure portal against the collected data.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: Resource to create: An Azure Log Analytics workspace
Resource on which to enable diagnostics: NSG1
Explanation: NSG flow logs capture the source IP addresses of traffic to the load balancer. Use Traffic Analytics with a Log Analytics workspace to query that data interactively in the Azure portal. A Basic internal load balancer does not provide the required connection logs.
$19
Get all 558 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
