Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure Active Directory (Azure AD) tenant named contoso.com.
You have a CSV file that contains the names and email addresses of 500 external users.
You need to create a guest user account in contoso.com for each of the 500 external users.
Solution: You create a PowerShell script that runs the New-MgInvitation cmdlet for each external user.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: A
Explanation: Yes. The Microsoft Graph PowerShell cmdlet New-MgInvitation is the correct cmdlet for inviting external users. A PowerShell script can import the CSV, iterate through the 500 users, and call New-MgInvitation for each user, supplying a common redirect URL if needed. This creates guest invitations, and upon redemption the users exist as guest accounts in the tenant.
Question 127
HOTSPOT
-
You need to configure a new Azure App Service app named WebApp1. The solution must meet the following requirements:
• WebApp1 must be able to verify a custom domain name of app.contoso.com.
• WebApp1 must be able to automatically scale up to eight instances.
• Costs and administrative effort must be minimized.
Which pricing plan should you choose, and which type of record should you use to verify the domain? To answer, select the appropriate options in the answer area.
NOTE: Each correct answer is worth one point.
Show Answer
Correct Answer: Pricing plan: Standard
Record type: TXT
Explanation: Standard is the lowest App Service plan that supports autoscale and can scale to at least eight instances. TXT records are used to verify ownership of a custom domain for Azure App Service.
Question 128
You have an Azure Storage account that contains 5,000 blobs accessed by multiple users.
You need to ensure that the users can view only specific blobs based on blob index tags.
What should you include in the solution?
A. a role assignment condition
B. a stored access policy
C. just-in-time (JIT) VM access
D. a shared access signature (SAS)
Show Answer
Correct Answer: A
Explanation: Azure Storage supports Azure ABAC through Azure RBAC role assignment conditions, allowing access to blobs to be restricted based on blob index tags (for example, permitting read access only when a blob has a specific tag/value). Stored access policies do not filter access by blob index tags, JIT VM access is unrelated, and while SAS can authorize access, it is not the mechanism used to enforce per-user viewing restrictions based on blob index tags in this scenario.
Question 129
You have an Azure Storage account named storage1.
For storage1, you create an encryption scope named Scope1.
Which storage types can you encrypt by using Scope?
A. file shares only
B. containers only
C. file shares and containers only
D. containers and tables only
E. file shares, containers, and tables only
F. file shares, containers, tables, and queues
Show Answer
Correct Answer: B
Explanation: Encryption scopes are a feature of Azure Blob Storage. They allow encryption to be scoped to a blob container or an individual blob. They do not apply to Azure Files, Tables, or Queues as encryption scopes.
Question 130
HOTSPOT
-
You have a hybrid deployment of Azure Active Directory (Azure AD) that contains the users shown in the following table.
You need to modify the JobTitle and UsageLocation attributes for the users.
For which users can you modify the attributes from Azure AD? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: JobTitle: User1 and User3 only
UsageLocation: User1, User2, and User3
Explanation: JobTitle is mastered on-premises for synchronized users, so it cannot be edited in Azure AD for User2. Cloud-only members and guests can be edited in Azure AD. UsageLocation is a cloud-managed attribute and can be modified in Azure AD for all listed users.
Question 131
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure Active Directory (Azure AD) tenant named contoso.com.
You have a CSV file that contains the names and email addresses of 500 external users.
You need to create a guest user account in contoso.com for each of the 500 external users.
Solution: You create a PowerShell script that runs the New-MgUser cmdlet for each external user.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: New-MgUser creates directory user objects, not Azure AD B2B guest invitations. To create guest accounts for external users, the appropriate approach is to use the invitation API/cmdlet (for example, New-MgInvitation), which creates the guest user and sends or manages the invitation process. Therefore, using New-MgUser for each external user does not meet the stated goal.
Question 132
You create an Azure VM named VM1 that runs Windows Server 2019.
VM1 is configured as shown in the exhibit. (Click the Exhibit tab.)
You need to enable Desired State Configuration for VM1.
What should you do first?
A. Connect to VM1.
B. Start VM1.
C. Capture a snapshot of VM1.
D. Configure a DNS name for VM1.
Show Answer
Correct Answer: B
Explanation: Desired State Configuration is enabled through the Azure VM DSC extension, which requires the VM to be running so the extension can be installed and executed. If the exhibit shows VM1 is stopped, the first step is to start it. Connecting, taking a snapshot, or configuring a DNS name are not prerequisites.
Question 133
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an app named App1 that is installed on two Azure virtual machines named VM1 and VM2. Connections to App1 are managed by using an Azure Load Balancer.
The effective network security configurations for VM2 are shown in the following exhibit.
You discover that connections to App1 from 131.107.100.50 over TCP port 443 fail.
You verify that the Load Balancer rules are configured correctly.
You need to ensure that connections to App1 can be established successfully from 131.107.100.50 over TCP port 443.
Solution: You create an inbound security rule that allows any traffic from the AzureLoadBalancer source and has a priority of 150.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: No. Creating an inbound NSG rule allowing AzureLoadBalancer traffic at priority 150 does not meet the goal. In the described effective security configuration, this rule is either already effectively allowed by the default AzureLoadBalancer rule or does not address the actual cause of the failed client connectivity (such as an existing higher-priority rule or the backend VM state). Adding a lower-priority AzureLoadBalancer allow rule would not change packet evaluation or restore connectivity.
Sources:
https://www.coursehero.com/file/p68s38ce/Question-15-Note-This-question-is-part-of-a-series-of-questions-that-present-the
Question 134
You have an Azure subscription that contains a Recovery Services vault named Vault1.
You need to enable multi-user authorization (MAU) for Vault1.
Which resource should you create first?
A. an administrative unit
B. a managed identity
C. a resource guard
D. a custom Azure role
Show Answer
Correct Answer: C
Explanation: To enable multi-user authorization (MUA) for an Azure Recovery Services vault, you must first create a Resource Guard. MUA is implemented by associating the Recovery Services vault with a Resource Guard, which provides the additional authorization layer required for protected operations. Administrative units, managed identities, and custom Azure roles are not the prerequisite resource for enabling MUA.
Question 135
HOTSPOT -
You have an Azure subscription that has offices in the East US and West US Azure regions.
You plan to create the storage account shown in the following exhibit.
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Default routing tier
Encryption type
Explanation: To minimize network costs, change the routing preference to Internet routing (Default routing tier). After creation, the encryption type (Microsoft-managed keys vs. customer-managed keys) can be modified, while the other listed encryption creation options cannot.
$19
Get all 555 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
