HOTSPOT
-
You have an Azure AD tenant.
You need to modify the Default user role permissions settings for the tenant. The solution must meet the following requirements:
• Standard users must be prevented from creating new service principals.
• Standard users must only be able to use PowerShell or Microsoft Graph to manage their own Azure resources.
Which two settings should you modify? To answer, select the appropriate settings in the answer area.
NOTE: Each correct answer is worth one point.
Show Answer
Correct Answer: Users can register applications → No
Restrict access to Azure AD administration portal → Yes
Explanation: Turning off application registration prevents standard users from creating application registrations (and corresponding service principals). Enabling restriction to the Azure AD administration portal prevents non-admin users from using the portal to manage Azure AD resources, leaving PowerShell and Microsoft Graph available for management of their own resources.
Question 116
You have an Azure subscription that contains the resources shown in the following table.
You need to assign Workspace1 a role to allow read, write, and delete operations for the data stored in the containers of storage1.
Which role should you assign?
A. Storage Account Contributor
B. Contributor
C. Storage Blob Data Contributor
D. Reader and Data Access
Show Answer
Correct Answer: C
Explanation: The required permissions are for data operations (read, write, and delete) on blobs stored within storage containers, not for managing the storage account resource itself. The built-in Azure RBAC role 'Storage Blob Data Contributor' grants read, write, and delete access to blob containers and blob data. 'Storage Account Contributor' manages the storage account resource but does not provide the appropriate data-plane permissions, 'Contributor' is unnecessarily broad, and 'Reader and Data Access' does not grant write/delete data access.
Question 118
HOTSPOT
-
You have an Azure subscription that contains a storage account named storage1.
You need to configure a shared access signature (SAS) to ensure that users can only download blobs securely by name.
Which two settings should you configure? To answer, select the appropriate settings in the answer area.
NOTE: Each correct answer is worth one point.
Explanation: To allow users to download a blob only by its name, the SAS should target the object resource type and grant only read permission. Listing or broader resource types are not required.
Question 119
HOTSPOT
-
You have an Azure subscription that contains the vaults shown in the following table.
You create a storage account that contains the resources shown in the following table.
To which vault can you back up cont1 and share1? To answer, select the appropriate options in the answer area.
NOTE: Each correct answer is worth one point.
Show Answer
Correct Answer: cont1: Backup1 only
share1: Recovery1 only
Explanation: Azure Blob container backup uses a Backup vault. Azure Files backup is supported with a Recovery Services vault in the expected exam context.
Question 120
You have an Azure subscription. The subscription contains virtual machines that connect to a virtual network named VNet1.
You plan to configure Azure Monitor for VM Insights.
You need to ensure that all the virtual machines only communicate with Azure Monitor through VNet1.
What should you create first?
A. a data collection rule (DCR)
B. a Log Analytics workspace
C. an Azure Monitor Private Link Scope (AMPLS)
D. a private endpoint
Show Answer
Correct Answer: C
Explanation: To force Azure Monitor traffic to remain on the virtual network, you use Azure Monitor Private Link. The first resource to create is an Azure Monitor Private Link Scope (AMPLS), which defines the Azure Monitor resources that can be accessed privately. After creating the AMPLS, you create a private endpoint in VNet1 and associate Azure Monitor resources (such as a Log Analytics workspace) with the scope. A data collection rule is configured later for VM Insights data collection.
Question 121
You have an Azure virtual machine named VM1 and an Azure key vault named Vault1.
On VM1, you plan to configure Azure Disk Encryption to use a key encryption key (KEK).
You need to prepare Vault1 for Azure Disk Encryption.
Which two actions should you perform on Vault1? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
A. Select Azure Virtual machines for deployment.
B. Create a new key.
C. Create a new secret.
D. Configure a key rotation policy.
E. Select Azure Disk Encryption for volume encryption.
Show Answer
Correct Answer: B, E
Explanation: To use Azure Disk Encryption with a key encryption key (KEK), the Key Vault must contain a key that will act as the KEK, and the Key Vault must be enabled for Azure Disk Encryption by allowing 'Azure Disk Encryption for volume encryption' in its access configuration. Creating a secret is not required for the KEK, key rotation is not required and is not used automatically by Azure Disk Encryption, and 'Azure Virtual Machines for deployment' is only needed for specific deployment scenarios, not as a general requirement for Azure Disk Encryption.
Question 122
HOTSPOT -
You have an Azure subscription that contains a virtual machine named VM1.
To VM1, you plan to add a 1-TB data disk that meets the following requirements:
• Provides data resiliency in the event of a datacenter outage.
• Provides the lowest latency and the highest performance.
• Ensures that no data loss occurs if a host fails.
You need to recommend which type of storage and host caching to configure for the new data disk.
Explanation: Premium SSD provides the highest performance and lowest latency. ZRS provides resilience across availability zones for datacenter outages. Read-only host caching improves read performance without the write-cache data loss risk associated with Read/Write caching.
Question 123
You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers.
You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines.
You need to ensure that visitors are serviced by the same web server for each request.
What should you configure?
A. Floating IP (direct server return) to Disabled
B. Idle Time-out (minutes) to 20
C. a health probe
D. Session persistence to Client IP
Show Answer
Correct Answer: D
Explanation: To keep a client consistently routed to the same backend web server across requests, configure the Azure Load Balancer's session persistence (load distribution) to Client IP. This enables source IP affinity ('sticky sessions'). Floating IP, idle timeout, and health probes do not provide client affinity.
Question 124
You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers.
You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines.
You need to ensure that visitors are serviced by the same web server for each request.
What should you configure?
A. Session persistence to Client IP
B. Idle Time-out (minutes) to 20
C. Session persistence to None
D. Protocol to UDP
Show Answer
Correct Answer: A
Explanation: To ensure a client is consistently routed to the same backend web server across requests, configure the Azure Load Balancer's session persistence (also called source IP affinity) to Client IP. This enables sticky sessions based on the client's source IP. Idle timeout only affects connection duration, Protocol=UDP is unrelated for web servers, and Session persistence=None disables affinity.
Question 125
You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers.
You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines.
You need to ensure that visitors are serviced by the same web server for each request.
What should you configure?
A. Session persistence to Client IP and protocol
B. Idle Time-out (minutes) to 20
C. Session persistence to None
D. Floating IP (direct server return) to Enabled
Show Answer
Correct Answer: A
Explanation: To ensure a client is consistently served by the same backend VM across requests, configure the Azure Load Balancer's session persistence (load distribution) to Client IP and protocol. This enables session affinity (sticky sessions) based on the client IP and protocol. Idle timeout only controls connection timeout, Floating IP is for direct server return scenarios, and Session persistence set to None disables affinity.
$19
Get all 555 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
