You have an Azure subscription named Subscription1 that contains a virtual network named VNet1. VNet1 is in a resource group named RG1.
Subscription1 has a user named User1. User1 has the following roles:
• Reader
• Security Admin
• Security Reader
You need to ensure that User1 can assign the Reader role for VNet1 to other users.
What should you do?
A. Remove User1 from the Security Reader role for Subscription1. Assign User1 the Contributor role for RG1.
B. Assign User1 the Access Administrator role for VNet1.
C. Remove User1 from the Security Reader and Reader roles for Subscription1. Assign User1 the Contributor role for Subscription1.
D. Assign User1 the Network Contributor role for RG1.
Show Answer
Correct Answer: B
Explanation: To create Azure RBAC role assignments, a user needs the Microsoft.Authorization/roleAssignments/write permission, which is included in the Owner or User Access Administrator (formerly referred to in some materials as Access Administrator) role. Reader, Security Admin, Security Reader, Contributor, and Network Contributor do not grant permission to assign RBAC roles. Assigning the Access Administrator/User Access Administrator role scoped to VNet1 provides the least-privilege capability needed to assign the Reader role on that virtual network.
Question 148
You have an Azure subscription that contains a storage account named storage1.
You plan to use conditions when assigning role-based access control (RBAC) roles to storage1.
Which storage1 services support conditions when assigning roles?
A. containers only
B. file shares only
C. tables only
D. queues only
E. containers and queues only
F. files shares and tables only
Show Answer
Correct Answer: E
Explanation: Azure RBAC role assignment conditions for Azure Storage currently apply to data actions for Blob Storage and Queue Storage. Blob access is scoped through containers, and queue data actions are supported. Azure Files and Table Storage do not support RBAC conditions for role assignments.
Question 149
You have an Azure subscription named Subscription1.
You have 5 TB of data that you need to transfer to Subscription1.
You plan to use an Azure Import/Export job.
What can you use as the destination of the imported data?
A. Azure Data Lake Store
B. Azure File Storage
C. Azure SQL Database
D. the Azure File Sync Storage Sync Service
Show Answer
Correct Answer: B
Explanation: Azure Import/Export supports importing data into Azure Storage accounts, including Azure Blob storage and Azure Files. Among the options, Azure File Storage (Azure Files) is a supported destination. It does not import directly into Azure Data Lake Store, Azure SQL Database, or the Azure File Sync Storage Sync Service.
Question 150
You have an Azure subscription named Subscription1.
You have 5 TB of data that you need to transfer to Subscription1.
You plan to use an Azure Import/Export job.
What can you use as the destination of the imported data?
A. an Azure Cosmos DB database
B. Azure Blob Storage
C. Azure SQL Database
D. the Azure File Sync Storage Sync Service
Show Answer
Correct Answer: B
Explanation: Azure Import/Export is designed to import data by shipping drives into Azure Blob Storage (and Azure Files). Among the listed options, only Azure Blob Storage is a valid destination. It does not import directly into Azure Cosmos DB, Azure SQL Database, or the Azure File Sync Storage Sync Service.
Question 151
You have an Azure subscription that contains the resources shown in the following table.
You need to assign User1 the Storage File Data SMB Share Contributor role for share1.
What should you do first?
A. Enable identity-based data access for the file shares in storage1.
B. Modify the security profile for the file shares in storage1.
C. Select Default to Azure Active Directory authorization in the Azure portal for storage1.
D. Configure Access control (IAM) for share1.
Show Answer
Correct Answer: A
Explanation: To assign the Storage File Data SMB Share Contributor role for Azure Files over SMB, the storage account must first have identity-based access enabled. Without configuring identity-based authentication for Azure Files, RBAC assignments for SMB access are not effective. After enabling identity-based access, you can assign the Storage File Data SMB Share Contributor role on the file share via IAM.
Question 152
DRAG DROP
-
You have a Windows 11 device named Device and an Azure subscription that contains the resources shown in the following table.
Device1 has Azure PowerShell and Azure Command-Line Interface (CLI) installed.
From Device1, you need to establish a Remote Desktop connection to VM1.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Show Answer
Correct Answer: Upgrade Bastion1 to the Standard SKU.
From Bastion1, select Native Client Support.
From Azure CLI on Device1, run az network bastion rdp.
Explanation: Azure Bastion Basic does not support native client connections. Native RDP via Azure CLI requires Azure Bastion Standard with Native Client Support enabled, then the az network bastion rdp command initiates the Remote Desktop session to the private VM.
Question 153
You have an Azure subscription named Subscription1 that contains a virtual network named VNet1. VNet1 is in a resource group named RG1.
Subscription1 has a user named User1. User1 has the following roles:
• Reader
• Security Admin
• Security Reader
You need to ensure that User1 can assign the Reader role for VNet1 to other users.
What should you do?
A. Remove User1 from the Security Reader role for Subscription1. Assign User1 the Contributor role for RG1.
B. Assign User1 the User Access Administrator role for VNet1.
C. Remove User1 from the Security Reader and Reader roles for Subscription1.
D. Assign User1 the Contributor role for VNet1.
Show Answer
Correct Answer: B
Explanation: To assign Azure RBAC roles, a user needs the Owner or User Access Administrator role at the relevant scope. Reader, Security Admin, and Security Reader do not grant permission to manage role assignments, and Contributor cannot assign RBAC roles. Assigning User Access Administrator at the VNet1 scope allows User1 to assign the Reader role for that virtual network.
Question 155
You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers.
You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines.
You need to ensure that visitors are serviced by the same web server for each request.
What should you configure?
A. Session persistence to Client IP and protocol
B. Protocol to UDP
C. Session persistence to None
D. Floating IP (direct server return) to Disabled
Show Answer
Correct Answer: A
Explanation: To keep a client consistently routed to the same backend web server (session affinity/sticky sessions) in an Azure Load Balancer, configure Session persistence to 'Client IP and protocol'. 'None' disables persistence, changing the protocol to UDP is unrelated, and Floating IP (DSR) is for specific load-balancing scenarios, not client affinity.
Question 156
You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers.
You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines.
You need to ensure that visitors are serviced by the same web server for each request.
What should you configure?
A. a health probe
B. Floating IP (direct server return) to Enabled
C. Session persistence to Client IP and protocol
D. Protocol to UDP
Show Answer
Correct Answer: C
Explanation: To keep a client consistently routed to the same backend web server (client affinity/sticky sessions), configure the Azure Load Balancer distribution mode with Session persistence set to Client IP and protocol. Health probes only determine backend health, Floating IP is for specific load-balancing scenarios such as SQL AGs, and changing the protocol to UDP is unrelated.
Question 157
Your on-premises network contains a VPN gateway.
You have an Azure subscription that contains the resources shown in the following table.
You need to ensure that all the traffic from VM1 to storage1 travels across the Microsoft backbone network.
What should you configure?
A. Azure Application Gateway
B. private endpoints
C. a network security group (NSG)
D. Azure Virtual WAN
Show Answer
Correct Answer: B
Explanation: Private endpoints (Azure Private Link) assign a private IP address in the virtual network to the storage account, ensuring traffic between VM1 and the storage account stays on the Microsoft backbone network and does not traverse the public internet. Application Gateway, NSGs, and Azure Virtual WAN do not provide this private connectivity for Azure Storage.
$19
Get all 555 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
