You have an Azure subscription named Subscription1.
You have 5 TB of data that you need to transfer to Subscription1.
You plan to use an Azure Import/Export job.
What can you use as the destination of the imported data?
A. Azure Data Factory
B. the Azure File Sync Storage Sync Service
C. Azure File Storage
D. Azure SQL Database
Show Answer
Correct Answer: C
Explanation: Azure Import/Export jobs support importing large volumes of data by shipping physical drives to Azure, and the supported destinations include Azure Blob Storage and Azure File Storage. The other options (Azure Data Factory, Azure File Sync service, and Azure SQL Database) are not valid direct destinations for Import/Export jobs.
Question 110
You have an Azure subscription named Subscription1 that contains virtual network named VNet1. VNet1 is in a resource group named RG1.
A user named User1 has the following roles for Subscription1:
• Reader
• Security Admin
• Security Reader
You need to ensure that User1 can assign the Reader role for VNet1 to other users.
What should you do?
A. Remove User1 from the Security Reader and Reader roles for Subscription1. Assign User1 the Contributor role for Subscription1.
B. Assign User1 the Contributor role for VNet1.
C. Assign User1 the Owner role for VNet1.
D. Assign User1 the Network Contributor role for RG1.
Show Answer
Correct Answer: C
Explanation: To assign Azure RBAC roles to other users, an account must have the Owner or User Access Administrator role at the required scope. User1 currently lacks permission to assign roles. Assigning the Owner role on VNet1 grants full access, including the ability to assign the Reader role for that virtual network. Contributor and Network Contributor cannot assign roles, and changing subscription-level roles is unnecessary.
Question 111
You have an Azure subscription that contains the virtual networks shown in the following table.
All the virtual networks are peered. Each virtual network contains nine virtual machines.
You need to configure secure RDP connections to the virtual machines by using Azure Bastion.
What is the minimum number of Bastion hosts required?
A. 1
B. 3
C. 9
D. 10
Show Answer
Correct Answer: A
Explanation: Azure Bastion can be used across peered virtual networks, including global VNet peering across regions. You do not need a Bastion host per VNet or per region as long as the VNets are peered. Therefore, a single Bastion host is sufficient to provide secure RDP access to all virtual machines in the peered VNets.
Question 112
You have an Azure subscription that contains a virtual machine named VM1 and an Azure key vault named KV1.
You need to configure encryption for VM1. The solution must meet the following requirements:
• Store and use the encryption key in KV1.
• Maintain encryption if VM1 is downloaded from Azure.
• Encrypt both the operating system disk and the data disks.
Which encryption method should you use?
A. customer-managed keys
B. Confidential disk encryption
C. Azure Disk Encryption
D. encryption at host
Show Answer
Correct Answer: C
Explanation: Azure Disk Encryption (ADE) encrypts both the operating system disk and data disks at the guest OS level using BitLocker (Windows) or DM-Crypt (Linux). ADE integrates with Azure Key Vault, allowing encryption keys (including customer-managed keys) to be stored and used from KV1. Because encryption is applied inside the VM, the disks remain encrypted even if the VM or disks are downloaded or exported from Azure. Other options do not meet all requirements simultaneously.
Question 113
HOTSPOT -
You have an Azure subscription that contains the virtual machines shown in the following table.
You create an Azure Compute Gallery named ComputeGallery1 as shown in the Azure Compute Gallery exhibit. (Click the Azure Compute Gallery tab.)
In ComputeGallery1, you create a virtual machine image definition named Image1 as shown in the image definition exhibit. (Click the Image Definition tab.)
For each of the following statements, select Yes if the statement is true. Otherwise, select No,
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: No
Yes
Yes
Explanation: Image1 is defined as Generation 1. A Gen 2 VM OS disk can’t be used for a Gen 1 image definition. VM2 and VM3 are Gen 1; region and vCPU settings are not blocking (vCPU is only a recommendation, and gallery/image regions don’t restrict source disk eligibility).
Question 114
You have an Azure AD tenant named contoso.com.
You have an Azure subscription that contains an Azure App Service web app named App1 and an Azure key vault named KV1. KV1 contains a wildcard certificate for contoso.com.
You have a user named
that is assigned the Owner role for App1 and KV1.
You need to configure App1 to use the wildcard certificate of KV1.
What should you do first?
A. Create an access policy for KV1 and assign the Microsoft Azure App Service principal to the policy.
B. Assign a managed user identity to App1.
C. Configure KV1 to use the role-based access control (RBAC) authorization system.
D. Create an access policy for KV1 and assign the policy to User1.
Show Answer
Correct Answer: B
Explanation: To allow an Azure App Service to access a certificate stored in Azure Key Vault, the app must have an Azure AD identity. The first required step is to enable a managed identity on App1 so it has a service principal in Azure AD. Only after the managed identity exists can you grant it permissions (via Key Vault access policy or RBAC) to read the certificate. Without assigning the managed identity, there is no identity to authorize against Key Vault.
Question 115
HOTSPOT
-
You have an Azure subscription that contains the container images shown in the following table.
You plan to use the following services:
• Azure Container Instances
• Azure Container Apps
• Azure App Service
In which services can you run the images? To answer, select the options in the answer area.
NOTE: Each correct answer is worth one point.
Show Answer
Correct Answer: Image1:
Azure Container Instances and App Services only
Image2:
Azure Container Instances, Azure Container Apps, and App Services
Explanation: Windows Server container images can run on Azure Container Instances and Azure App Service (Windows), but not on Azure Container Apps (Linux-only).
Linux container images are supported by Azure Container Instances, Azure Container Apps, and Azure App Service (Linux).
Question 116
You have an Azure App Service app named App1 that contains two running instances.
You have an autoscale rule configured as shown in the following exhibit.
For the Instance limits scale condition setting, you set Maximum to 5.
During a 30-minute period, App1 uses 80 percent of the available memory.
What is the maximum number of instances for App1 during the 30-minute period?
A. 2
B. 3
C. 4
D. 5
Show Answer
Correct Answer: D
Explanation: Azure Autoscale uses a sliding evaluation window. The 15-minute duration is required only to trigger the first scale action. After a scale-out occurs, the cooldown (5 minutes) is enforced, but the metric evaluation continues using the rolling window. If memory usage remains above the threshold after each cooldown, additional scale-out actions can occur immediately (one per cooldown) until the instance limit is reached. Starting from 2 instances and with a maximum of 5, App1 can scale out to 5 instances within the 30-minute period.
Question 117
HOTSPOT -
You have the Azure virtual machines shown in the following table.
VNET1, VNET2, and VNET3 are peered.
VM4 has a DNS server that is authoritative for a zone named contoso.com and contains the records shown in the following table.
The virtual networks are configured to use the DNS servers shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: No
Yes
No
Explanation: VM1 uses Azure-provided DNS, which is not aware of the custom authoritative DNS zone hosted on VM4, so server1.contoso.com does not resolve to the given IP.
VM2 uses a custom DNS server (192.168.0.5), which is VM4 and is authoritative for contoso.com, so server1.contoso.com resolves correctly.
VM3 also uses VM4 for DNS, but the queried IP (131.107.2.4) does not match the actual A record (131.107.3.4), so the resolution is incorrect.
Question 118
HOTSPOT -
You have an Azure subscription named Sub1 that contains the blob containers shown in the following table.
Sub1 contains two users named User1 and User2. Both users are assigned the Reader role at the Sub1 scope.
You have a condition named Condition1 as shown in the following exhibit.
You have a condition named Condition2 as shown in the following exhibit.
You assign roles to User1 and User2 as shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: No
No
Yes
Explanation: Condition1 limits read actions to container cont1 only. Therefore, User1 cannot read blob2 (cont2) or blob3 (cont3).
Condition2 applies only to write actions and restricts writes to blob paths matching *2*. User2’s read action on blob1 is unaffected, so reading blob1 is allowed.
$19
Get all 558 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
