Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure Active Directory (Azure AD) tenant named contoso.com.
You have a CSV file that contains the names and email addresses of 500 external users.
You need to create a guest user account in contoso.com for each of the 500 external users.
Solution: You create a PowerShell script that runs the New-MgInvitation cmdlet for each external user.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: A
Explanation: New-MgInvitation is the Microsoft Graph PowerShell cmdlet designed to invite external users to an Azure AD tenant. When the invitation is sent and redeemed, the external user is created as a guest user in the directory. A PowerShell script can loop through the CSV file and call New-MgInvitation for each of the 500 users (including specifying a redirect URL in the script), which meets the requirement to create guest user accounts.
Question 132
You have an Azure Storage account that contains 5,000 blobs accessed by multiple users.
You need to ensure that the users can view only specific blobs based on blob index tags.
What should you include in the solution?
A. a role assignment condition
B. a stored access policy
C. just-in-time (JIT) VM access
D. a shared access signature (SAS)
Show Answer
Correct Answer: A
Explanation: To restrict users so they can view only blobs that match specific blob index tags, Azure supports attribute-based access control (ABAC) through role assignment conditions. A role assignment condition can evaluate blob index tags at access time and allow read access only when the tag criteria are met. SAS can grant permissions but cannot inherently enforce dynamic tag-based authorization across many users, and stored access policies and JIT VM access are not applicable for tag-based blob filtering.
Question 133
You have an Azure Storage account named storage1.
For storage1, you create an encryption scope named Scope1.
Which storage types can you encrypt by using Scope?
A. file shares only
B. containers only
C. file shares and containers only
D. containers and tables only
E. file shares, containers, and tables only
F. file shares, containers, tables, and queues
Show Answer
Correct Answer: B
Explanation: Azure encryption scopes are a feature of Azure Blob Storage. They let you scope encryption keys at the container level or individual blob level. Encryption scopes do not apply to Azure Files (file shares), Tables, or Queues. Therefore, among the listed storage types, only containers can be encrypted using an encryption scope.
Question 134
HOTSPOT
-
You have a hybrid deployment of Azure Active Directory (Azure AD) that contains the users shown in the following table.
You need to modify the JobTitle and UsageLocation attributes for the users.
For which users can you modify the attributes from Azure AD? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: JobTitle:
User1 and User3 only
UsageLocation:
User1, User2, and User3
Explanation: JobTitle is mastered on-premises for synced users, so it can’t be edited in Azure AD for User2. Cloud-only members and guests can be edited in Azure AD. UsageLocation is a cloud-only attribute and can be set in Azure AD for all users, including synced and guest users.
Question 135
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure Active Directory (Azure AD) tenant named contoso.com.
You have a CSV file that contains the names and email addresses of 500 external users.
You need to create a guest user account in contoso.com for each of the 500 external users.
Solution: You create a PowerShell script that runs the New-MgUser cmdlet for each external user.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: New-MgUser is used to create member users in the tenant. External users must be created as guest (B2B) users via an invitation process, such as using New-MgInvitation (or the equivalent Azure AD invitation cmdlets). Therefore, using New-MgUser for external guests does not meet the requirement.
Question 136
You create an Azure VM named VM1 that runs Windows Server 2019.
VM1 is configured as shown in the exhibit. (Click the Exhibit tab.)
You need to enable Desired State Configuration for VM1.
What should you do first?
A. Connect to VM1.
B. Start VM1.
C. Capture a snapshot of VM1.
D. Configure a DNS name for VM1.
Show Answer
Correct Answer: B
Explanation: Desired State Configuration is enabled through a VM extension, which can only be installed and run when the virtual machine is powered on. The exhibit shows VM1 is stopped, so the first required action is to start the VM.
Question 137
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an app named App1 that is installed on two Azure virtual machines named VM1 and VM2. Connections to App1 are managed by using an Azure Load Balancer.
The effective network security configurations for VM2 are shown in the following exhibit.
You discover that connections to App1 from 131.107.100.50 over TCP port 443 fail.
You verify that the Load Balancer rules are configured correctly.
You need to ensure that connections to App1 can be established successfully from 131.107.100.50 over TCP port 443.
Solution: You create an inbound security rule that allows any traffic from the AzureLoadBalancer source and has a priority of 150.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: A
Explanation: Yes. When traffic reaches the VM through an Azure Load Balancer, the effective source seen by the VM is the AzureLoadBalancer service, not the original client IP. An inbound NSG rule allowing traffic from the AzureLoadBalancer source with a higher priority (150) permits both health probe traffic and forwarded client connections, overriding the broader deny rule and allowing TCP 443 connections to App1 to succeed.
Question 138
You have an Azure subscription that contains a Recovery Services vault named Vault1.
You need to enable multi-user authorization (MAU) for Vault1.
Which resource should you create first?
A. an administrative unit
B. a managed identity
C. a resource guard
D. a custom Azure role
Show Answer
Correct Answer: C
Explanation: To enable multi-user authorization (MUA) for a Recovery Services vault, you must first create a Resource Guard. MUA works by associating the vault with a Resource Guard, which enforces an additional authorization check for critical operations. Other resources like managed identities, custom roles, or administrative units are not prerequisites for enabling MUA.
Question 139
HOTSPOT -
You have an Azure subscription that has offices in the East US and West US Azure regions.
You plan to create the storage account shown in the following exhibit.
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Default routing tier
Encryption type
Explanation: Network egress cost is optimized by changing the routing preference to Internet routing via the Default routing tier. After the storage account is created, the encryption model can still be changed by modifying the Encryption type (switching between Microsoft-managed and customer-managed keys), while the other listed options cannot be modified post-creation.
Question 140
You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers.
You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines.
You need to ensure that visitors are serviced by the same web server for each request.
What should you configure?
A. Floating IP (direct server return) to Enabled
B. Idle Time-out (minutes) to 20
C. a health probe
D. Session persistence to Client IP
Show Answer
Correct Answer: D
Explanation: The requirement is to ensure that the same client is consistently directed to the same backend web server across multiple requests (sticky sessions). In Azure Load Balancer, this is achieved by configuring Session persistence. Setting session persistence to Client IP ensures requests from the same client IP are routed to the same virtual machine. Other options do not provide request affinity: Floating IP is for direct server return, Idle Time-out controls connection duration, and a health probe only monitors backend availability.
$19
Get all 558 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
