You have an Azure subscription named Subscription1.
You have 5 TB of data that you need to transfer to Subscription1.
You plan to use an Azure Import/Export job.
What can you use as the destination of the imported data?
A. Azure Data Lake Store
B. Azure File Storage
C. Azure SQL Database
D. the Azure File Sync Storage Sync Service
Show Answer
Correct Answer: B
Explanation: Azure Import/Export jobs support importing large amounts of data into Azure Storage services, specifically Azure Blob Storage and Azure File Storage. They do not support Azure Data Lake Store, Azure SQL Database, or Azure File Sync as direct import destinations. Therefore, Azure File Storage is a valid destination for imported data.
Question 154
You have an Azure subscription named Subscription1.
You have 5 TB of data that you need to transfer to Subscription1.
You plan to use an Azure Import/Export job.
What can you use as the destination of the imported data?
A. an Azure Cosmos DB database
B. Azure Blob Storage
C. Azure SQL Database
D. the Azure File Sync Storage Sync Service
Show Answer
Correct Answer: B
Explanation: Azure Import/Export jobs support importing large volumes of data by shipping physical drives to an Azure datacenter. The supported destinations for imported data are Azure Blob Storage and Azure Files. Among the options provided, only Azure Blob Storage is a valid destination. Azure Cosmos DB, Azure SQL Database, and Azure File Sync are not supported Import/Export targets.
Question 155
You have an Azure subscription that contains the resources shown in the following table.
You need to assign User1 the Storage File Data SMB Share Contributor role for share1.
What should you do first?
A. Enable identity-based data access for the file shares in storage1.
B. Modify the security profile for the file shares in storage1.
C. Select Default to Azure Active Directory authorization in the Azure portal for storage1.
D. Configure Access control (IAM) for share1.
Show Answer
Correct Answer: A
Explanation: To assign the **Storage File Data SMB Share Contributor** role, Azure Files must first support Azure AD/Kerberos authentication. This requires enabling **identity-based data access** at the storage account level. Until identity-based authentication is enabled, assigning the SMB data plane role on the file share is ineffective. Only after this step can IAM role assignments on the share work as intended.
Question 156
DRAG DROP
-
You have a Windows 11 device named Device and an Azure subscription that contains the resources shown in the following table.
Device1 has Azure PowerShell and Azure Command-Line Interface (CLI) installed.
From Device1, you need to establish a Remote Desktop connection to VM1.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Show Answer
Correct Answer: Upgrade Bastion1 to the Standard SKU.
From Bastion1, select Native Client Support.
From Azure CLI on Device1, run az network bastion rdp.
Explanation: Connecting to a VM without a public IP by using a native RDP client through Azure Bastion requires the Bastion Standard SKU and Native Client Support. After enabling these, the RDP session is initiated from Device1 by using the Azure CLI bastion rdp command.
Question 157
You have an Azure subscription named Subscription1 that contains a virtual network named VNet1. VNet1 is in a resource group named RG1.
Subscription1 has a user named User1. User1 has the following roles:
• Reader
• Security Admin
• Security Reader
You need to ensure that User1 can assign the Reader role for VNet1 to other users.
What should you do?
A. Remove User1 from the Security Reader role for Subscription1. Assign User1 the Contributor role for RG1.
B. Assign User1 the User Access Administrator role for VNet1.
C. Remove User1 from the Security Reader and Reader roles for Subscription1.
D. Assign User1 the Contributor role for VNet1.
Show Answer
Correct Answer: B
Explanation: To assign Azure RBAC roles, a user must have the Owner role or the User Access Administrator role at the required scope. User1 currently only has Reader, Security Admin, and Security Reader roles, none of which allow role assignments. Assigning the User Access Administrator role at the VNet1 scope grants User1 permission to assign the Reader role for that virtual network without giving broader resource management rights.
Question 159
You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers.
You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines.
You need to ensure that visitors are serviced by the same web server for each request.
What should you configure?
A. Session persistence to Client IP and protocol
B. Protocol to UDP
C. Session persistence to None
D. Floating IP (direct server return) to Disabled
Show Answer
Correct Answer: A
Explanation: Ensuring that visitors are serviced by the same web server for each request requires session affinity (sticky sessions). In Azure Load Balancer, this is achieved by configuring Session persistence to Client IP and protocol, which consistently maps a client’s requests to the same backend VM.
Question 160
You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers.
You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines.
You need to ensure that visitors are serviced by the same web server for each request.
What should you configure?
A. a health probe
B. Floating IP (direct server return) to Enabled
C. Session persistence to Client IP and protocol
D. Protocol to UDP
Show Answer
Correct Answer: C
Explanation: To ensure that each visitor is consistently served by the same backend web server, Azure Load Balancer must use session persistence (also called client affinity). Configuring session persistence to **Client IP and protocol** ensures that requests from the same client are directed to the same virtual machine for the duration of the session. The other options do not provide request stickiness.
Question 161
Your on-premises network contains a VPN gateway.
You have an Azure subscription that contains the resources shown in the following table.
You need to ensure that all the traffic from VM1 to storage1 travels across the Microsoft backbone network.
What should you configure?
A. Azure Application Gateway
B. private endpoints
C. a network security group (NSG)
D. Azure Virtual WAN
Show Answer
Correct Answer: B
Explanation: To ensure traffic from VM1 to an Azure Storage account stays on the Microsoft backbone and does not traverse the public internet, you must use Azure Private Link via a private endpoint. A private endpoint assigns a private IP from the VNet to the storage account, so traffic flows privately over the Microsoft backbone. Application Gateway, NSGs, and Virtual WAN do not provide private connectivity to PaaS services like Azure Storage.
Question 162
You have an Azure subscription named Subscription1 that contains a virtual network named VNet1. VNet1 is in a resource group named RG1.
Subscription1 has a user named User1. User1 has the following roles:
• Reader
• Security Admin
• Security Reader
You need to ensure that User1 can assign the Reader role for VNet1 to other users.
What should you do?
A. Remove User1 from the Security Reader role for Subscript on 1. Assign User1 the Contributor role for RG1.
B. Assign User1 the Owner role for VNet1.
C. Remove User1 from the Security Reader and Reader roles for Subscription1. Assign User1 the Contributor role for Subscription 1.
D. Assign User1 the Contributor role for VNet1.
Show Answer
Correct Answer: B
Explanation: To assign Azure RBAC roles, a user must have the **Owner** role or **User Access Administrator** at the required scope. The Contributor role does **not** allow role assignments. Assigning User1 the Owner role on VNet1 grants the minimum scope needed to assign the Reader role for that virtual network to other users.
Question 163
You have an Azure subscription that has the public IP addresses shown in the following table.
You plan to deploy an Instance of Azure Firewall Premium named FW1.
Which IP addresses can you use?
A. IP2 only
B. IP1 and IP2 only
C. IP1, IP2, and IP5 only
D. IP1, IP2, IP4, and IP5 only
Show Answer
Correct Answer: B
Explanation: Azure Firewall Premium requires public IP addresses that are **Static**, **Standard SKU**, and **IPv4**. It does not support Dynamic IPs, Basic SKU public IPs, public IP prefixes, or IPv6 addresses. From the listed options, only IP1 and IP2 meet all these requirements, so the correct choice is B.
$19
Get all 558 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
