HOTSPOT
-
You create a Recovery Services vault backup policy named Policy1 as shown in the following exhibit:
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Sunday, March 1: 10 years
Sunday, November 1: 36 months
Explanation: March 1 qualifies as a yearly backup point (day-based, March 1) and is retained for 10 years, which overrides shorter retentions. November 1 qualifies as a monthly backup point (day-based, 1st of the month) and is retained for 36 months.
Question 96
HOTSPOT
-
You have an Azure subscription.
You plan to create a role definition to meet the following requirements:
• Users must be able to view the configuration data of a storage account.
• Users must be able to perform all actions on a virtual network.
• The solution must use the principle of least privilege.
What should you include in the role definition for each requirement? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Perform all actions on a virtual network:
Microsoft.Network/virtualNetworks/*
View the configuration data of a storage account:
Microsoft.Storage/storageAccounts/read
Explanation: Using virtualNetworks/* grants all required operations (read, write, delete) on a virtual network. Using storageAccounts/read allows viewing storage account configuration without granting data access or modification rights, satisfying least privilege.
Question 97
You have an Azure subscription that contains a resource group named RG1 and a virtual network named VNet1.
You plan to create an Azure container instance named container1.
You need to be able to configure DNS name label scope reuse for container1.
What should you configure for container1?
A. the private networking type
B. the public networking type
C. a new subnet on VNet1
D. a confidential SKU
Show Answer
Correct Answer: B
Explanation: DNS name label scope reuse for Azure Container Instances is only available when the container uses the public networking type. The DNS name label is associated with a public IP and can be reused within the defined scope. Private networking, subnets, or confidential SKUs do not support configuring DNS name label reuse.
Question 98
HOTSPOT
-
You have an Azure AD tenant.
You need to create a Microsoft 365 group that contains only members of a marketing department in France.
How should you complete the dynamic membership rule? To answer, select the appropriate options in the answer area.
NOTE: Each correct answer is worth one point.
Explanation: Use the user.department attribute to filter Marketing users and combine it with the user.country attribute using the -and operator and -eq comparison to include only users located in France.
Question 99
You have an Azure subscription named Subscription1 that contains virtual network named VNet1. VNet1 is in a resource group named RG1.
User named User1 has the following roles for Subscription1:
• Reader
• Security Admin
• Security Reader
You need to ensure that User1 can assign the Reader role for VNet1 to other users.
What should you do?
A. Remove User1 from the Security Reader and Reader roles for Subscription1. Assign User1 the Contributor role for Subscription1.
B. Remove User1 from the Security Reader role for Subscription1. Assign User1 the Contributor role for RG1.
C. Assign User1 the Network Contributor role for VNet1.
D. Assign User1 the User Access Administrator role for VNet1.
Show Answer
Correct Answer: D
Explanation: To assign Azure RBAC roles, a user must have permission to manage access (Microsoft.Authorization/*). Built-in roles that allow this are Owner and User Access Administrator. Contributor, Network Contributor, Reader, and Security roles do not permit role assignment. Assigning User1 the User Access Administrator role at the VNet1 scope allows User1 to assign the Reader role to other users for that virtual network without granting broader management permissions.
Question 100
You have an Azure subscription named Subscription1 that contains virtual network named VNet1. VNet1 is in a resource group named RG1.
A user named User1 has the following roles for Subscription1:
• Reader
• Security Admin
• Security Reader
You need to ensure that User1 can assign the Reader role for VNet1 to other users.
What should you do?
A. Assign User1 the Contributor role for VNet1.
B. Assign User1 the Network Contributor role for VNet1.
C. Assign User1 the User Access Administrator role for VNet1.
D. Remove User1 from the Security Reader and Reader roles for Subscription1. Assign User1 the Contributor role for Subscription1.
Show Answer
Correct Answer: C
Explanation: Assigning Azure RBAC roles requires permissions to manage access. The Contributor and Network Contributor roles cannot assign roles. The User Access Administrator role explicitly allows managing user access and role assignments at the specified scope, so assigning it on VNet1 enables User1 to grant the Reader role on that virtual network.
Question 102
You have an Azure subscription that contains the virtual networks shown in the following table.
The subscription contains the virtual machines shown in the following table.
All the virtual machines have only private IP addresses.
You deploy an Azure Bastion host named Bastion1 to VNet1.
To which virtual machines can you connect through Bastion1?
A. VM1 only
B. VM1 and VM2 only
C. VM1 and VM3 only
D. VM1, VM2, and VM3
Show Answer
Correct Answer: B
Explanation: Azure Bastion can connect to VMs in the same VNet where it is deployed and in VNets that are directly peered with that VNet. Bastion does not support transitive (chained) peering. Since Bastion1 is deployed in VNet1, it can connect to VM1 (in VNet1) and VM2 (in VNet2, which is directly peered with VNet1). VM3 is in VNet3, which is not directly peered with VNet1, so it is not reachable through Bastion1.
Question 103
DRAG DROP
-
You have an Azure subscription that contains a resource group named RG1.
You plan to create an Azure Resource Manager (ARM) template to deploy a new virtual machine named VM1. VM1 must support the capture of performance data.
You need to specify resource dependencies for the ARM template.
In which order should you deploy the resources? To answer, move all resources from the list of resources to the answer area and arrange them in the correct order.
Explanation: A virtual network is required before creating a NIC. The NIC must exist before the VM can be deployed. The Azure Monitor (performance) extension is installed after the VM is created to collect performance data.
Question 106
You plan to create the Azure web apps shown in the following table.
What is the minimum number of App Service plans you should create for the web apps?
A. 1
B. 2
C. 3
D. 4
Show Answer
Correct Answer: B
Explanation: The minimum number of App Service plans is determined by the operating system, not by the individual runtime stacks. Windows and Linux apps cannot share the same App Service plan. ASP.NET v4.8 requires Windows, while Python requires Linux (without custom containers). The remaining stacks can run on either OS and be grouped accordingly. Therefore, at least two App Service plans are required: one Windows plan and one Linux plan.
Question 108
HOTSPOT -
You have an Azure subscription that contains the virtual networks shown in the following table.
The subnets have the IP address spaces shown in the following table.
You plan to create a container app named contapp1 in the East US Azure region.
You need to create a container app environment named con-env1 that meets the following requirements:
• Uses its own virtual network.
• Uses its own subnet.
• Is connected to the smallest possible subnet.
To which virtual networks can you connect con-env1, and which subnet mask should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Virtual network:
VNet3 only
Subnet mask:
/23
Explanation: Azure Container Apps (consumption-only environment) require a minimum subnet size of /23 (512 IPs). VNet1 has only a /24 available, and VNet2’s address space is fully consumed by existing /17 subnets. VNet3 has sufficient unused address space to create a new /23 subnet, meeting all requirements.
$19
Get all 558 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.