You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers.
You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines.
You need to ensure that visitors are serviced by the same web server for each request.
What should you configure?
A. Floating IP (direct server return) to Disabled
B. Floating IP (direct server return) to Enabled
C. a health probe
D. Session persistence to Client IP
Show Answer
Correct Answer: D
Explanation: To ensure that the same visitor is consistently serviced by the same backend web server, Azure Load Balancer must use session persistence (also called source IP affinity). Configuring Session persistence to Client IP ensures that all requests from a given client IP address are directed to the same virtual machine for the duration of the session. Floating IP and health probes do not provide client affinity.
Question 142
You have two Azure subscriptions named Sub1 and Sub2.
Sub1 contains a virtual machine named VM1 and a storage account named storage1.
VM1 is associated to the resources shown in the following table.
You need to move VM1 to Sub2.
Which resources should you move to Sub2?
A. VM1, Disk1, and NetInt1 only
B. VM1, Disk1, and VNet1 only
C. VM1, Disk1, and storage1 only
D. VM1, Disk1, NetInt1, and VNet1
Show Answer
Correct Answer: D
Explanation: To move a virtual machine to another subscription, all dependent resources that cannot exist independently must be moved together. VM1 depends on its managed OS disk (Disk1) and its network interface (NetInt1). The network interface is connected to a subnet within VNet1, so the virtual network must also be moved. The storage account is not required because the VM uses managed disks, not unmanaged disks stored in a storage account.
Question 143
You have an Azure subscription that has the public IP addresses shown in the following table.
You plan to deploy an Azure Bastion Basic SKU host named Bastion1.
Which IP addresses can you use?
A. IP1 only
B. IP1 and IP2 only
C. IP3, IP4, and IP5 only
D. IP1, IP2, IP4, and IP5 only
E. IP1, IP2, IP3, IP4, and IP5
Show Answer
Correct Answer: A
Explanation: Azure Bastion (including the Basic SKU) requires a **Standard SKU**, **Static**, **IPv4**, **Regional** public IP address. It does **not** support Basic SKU public IPs, Dynamic allocation, IPv6 addresses, or **Global tier** Standard IPs (Global tier is supported only via cross‑region load balancers, not Bastion). From the listed IPs, only IP1 meets all these requirements, so only IP1 can be used.
Question 144
HOTSPOT -
You have an Azure AD tenant named adatum.com that contains the groups shown in the following table.
Adatum.com contains the users shown in the following table.
You assign an Azure Active Directory Premium P2 license to Group1 as shown in the following exhibit.
Group2 is NOT directly assigned a license.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Yes
No
No
Explanation: Group-based licensing applies only to direct user members. User1 is a direct member of Group1, so additional service plans (such as Defender for Cloud Apps Discovery) can be assigned to the user. A license assigned via a group cannot be removed directly from an individual user. Nested groups do not inherit licenses, so User2 does not receive Azure AD Premium P2.
Question 146
HOTSPOT
-
You have an Azure subscription.
You need to deploy a virtual machine by using an Azure Resource Manager (ARM) template.
How should you complete the template? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation: The virtual machine must depend on the network interface, which is correctly referenced using the resourceId() function in dependsOn. The storageProfile uses imageReference to define the publisher, offer, SKU, and version of the Windows Server image used to create the VM.
Question 147
HOTSPOT
-
You have an Azure subscription.
You plan to deploy a new storage account.
You need to configure encryption for the account. The solution must meet the following requirements:
• Use a customer-managed key stored in a key vault.
• Use the maximum supported bit length.
Which type of key and which bit length should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Key: RSA
Bit length: 4096
Explanation: Azure Storage customer-managed keys in Azure Key Vault support RSA (or RSA-HSM) keys with sizes 2048, 3072, and 4096 bits. The maximum supported bit length is 4096, so RSA 4096 meets the requirements.
Question 149
HOTSPOT
-
You have three Azure subscriptions named Sub1, Sub2, and Sub3 that are linked to an Azure AD tenant.
The tenant contains a user named User1, a security group named Group1, and a management group named MG1. User is a member of Group1.
Sub1 and Sub2 are members of MG1. Sub1 contains a resource group named RG1. RG1 contains five Azure functions.
You create the following role assignments for MG1:
• Group1: Reader
• User1: User Access Administrator
You assign User the Virtual Machine Contributor role for Sub1 and Sub2.
Show Answer
Correct Answer: Yes
Yes
No
Explanation: 1) Group1 has the Reader role at the management group scope (MG1), which is inherited by Sub1 and RG1, allowing members to view Azure Function configurations.
2) User1 has the User Access Administrator role at MG1, which allows assigning any RBAC role (including Owner) on RG1.
3) User1 lacks permissions to create resource groups. Virtual Machine Contributor allows managing VMs only, and User Access Administrator does not grant resource creation rights.
Question 150
You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers.
You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines.
You need to ensure that visitors are serviced by the same web server for each request.
What should you configure?
A. Floating IP (direct server return) to Enabled
B. Session persistence to Client IP
C. Protocol to UDP
D. Idle Time-out (minutes) to 20
Show Answer
Correct Answer: B
Explanation: To ensure that the same client is always routed to the same backend web server, you must configure session persistence (also called affinity) on the Azure Load Balancer. Setting session persistence to Client IP ensures that all requests from a given client IP are consistently sent to the same virtual machine.
Question 151
You have an Azure subscription named Subscription1 that contains a virtual network named VNet1. VNet1 is in a resource group named RG1.
Subscription1 has a user named User1. User1 has the following roles:
• Reader
• Security Admin
• Security Reader
You need to ensure that User1 can assign the Reader role for VNet1 to other users.
What should you do?
A. Remove User1 from the Security Reader role for Subscription1. Assign User1 the Contributor role for RG1.
B. Assign User1 the Access Administrator role for VNet1.
C. Remove User1 from the Security Reader and Reader roles for Subscription1. Assign User1 the Contributor role for Subscription1.
D. Assign User1 the Network Contributor role for RG1.
Show Answer
Correct Answer: B
Explanation: To assign Azure RBAC roles, a user must have the permission Microsoft.Authorization/roleAssignments/write. This permission is included in the Owner role and the User Access Administrator (also referred to as Access Administrator) role. None of User1’s existing roles (Reader, Security Admin, Security Reader) allow role assignment. Assigning the Access Administrator role scoped to VNet1 grants exactly the required permission to assign the Reader role on that virtual network without providing unnecessary resource management rights. Other options either do not allow role assignment or grant excessive permissions.
Question 152
You have an Azure subscription that contains a storage account named storage1.
You plan to use conditions when assigning role-based access control (RBAC) roles to storage1.
Which storage1 services support conditions when assigning roles?
A. containers only
B. file shares only
C. tables only
D. queues only
E. containers and queues only
F. files shares and tables only
Show Answer
Correct Answer: E
Explanation: Azure RBAC conditions are currently supported only for role assignments that include Blob Storage or Queue Storage data actions. In a storage account, this maps to blob containers and queues. File shares and tables do not support RBAC conditions, so the correct choice is containers and queues only.
$19
Get all 558 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
