HOTSPOT
-
You have an Azure subscription that contains a user named User1 and the resources shown in the following table.
NSG1 is associated to networkinterface1.
User1 has role assignments for NSG1 as shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Yes
No
Yes
Explanation: 1) Storage Account Contributor at the resource group scope allows creating and managing storage accounts in RG1.
2) Modifying DNS settings of a NIC requires permissions on the network interface (e.g., Network Contributor) at the NIC/RG scope; roles on NSG1 don’t grant this.
3) Contributor on NSG1 allows creating inbound security rules on that NSG, which filters traffic to the associated NIC.
Question 165
You have an Azure subscription.
You need to receive an email alert when a resource lock is removed from any resource in the subscription.
What should you use to create an activity log alert in Azure Monitor?
A. a resource, a condition, and an action group
B. a resource, a condition, and a Microsoft 365 group
C. a Log Analytics workspace, a resource, and an action group
D. a data collection endpoint, an application security group, and a resource group
Show Answer
Correct Answer: A
Explanation: An Azure Monitor activity log alert is created by selecting the target resource scope (such as the subscription), defining a condition based on an activity log event (for example, the Delete Management Lock operation), and associating an action group to send notifications like email. No Log Analytics workspace, Microsoft 365 group, or data collection components are required for activity log alerts.
Question 167
You have an Azure subscription named Subscription1.
You have 5 TB of data that you need to transfer to Subscription1.
You plan to use an Azure Import/Export job.
What can you use as the destination of the imported data?
A. an Azure Cosmos DB database
B. Azure Data Lake Store
C. Azure Blob storage
D. Azure Data Factory
Show Answer
Correct Answer: C
Explanation: Azure Import/Export jobs support importing data only into Azure Storage services—specifically Azure Blob Storage and Azure Files. Among the options given, Azure Blob storage is the valid destination. Azure Cosmos DB, Azure Data Lake Store, and Azure Data Factory are not supported as direct Import/Export destinations.
Question 168
HOTSPOT
-
You have an Azure subscription that contains a storage account named storage1. The storage1 account contains a container named container1.
You create a blob lifecycle rule named rule1.
You need to configure rule1 to automatically move blobs that were NOT updated for 45 days from contained to the Cool access tier.
How should you complete the rule? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation: “Not updated” corresponds to the last modification time, so the rule must use daysAfterModificationGreaterThan with a value of 45. TierToCool is supported only for block blobs, so the blob type filter must be BlockBlob.
Question 169
You have an Azure subscription that contains a virtual machine named VM1 and an Azure function named App1.
You need to create an alert rule that will run App1 if VM1 stops.
What should you create for the alert rule?
A. an application security group
B. a security group that has dynamic device membership
C. an action group
D. an application group
Show Answer
Correct Answer: C
Explanation: To run an Azure Function when a virtual machine stops, the alert rule must trigger an automated action. In Azure Monitor, this is done by associating the alert rule with an action group. Action groups define what happens when an alert fires, including invoking an Azure Function. The other options are unrelated to alert actions.
Question 170
You have an Azure subscription that contains a storage account named storage1 in the North Europe Azure region.
You need to ensure that when blob data is added to storage1, a secondary copy is created in the East US region. The solution must minimize administrative effort.
What should you configure?
A. operational backup
B. object replication
C. geo-redundant storage (GRS)
D. a lifecycle management rule
Show Answer
Correct Answer: B
Explanation: The requirement is to create a secondary copy of blob data specifically in the East US region. Geo-redundant storage (GRS) automatically replicates data only to the Azure paired region (for North Europe, this is West Europe), and you cannot choose East US. Object replication allows you to explicitly configure replication of blobs to a storage account in a region of your choice, such as East US, and it automatically replicates new blob data once configured. The other options do not provide cross-region replication.
Question 171
You have an Azure subscription that contains two Log Analytics workspaces named Workspace1 and Workspace2 and 100 virtual machines that run Windows Server.
You need to collect performance data and events from the virtual machines. The solution must meet the following requirements:
• Logs must be sent to Workspace1 and Workspace 2.
• All Windows events must be captured.
• All security events must be captured.
What should you install and configure on each virtual machine?
A. the Azure Monitor agent
B. the Windows Azure diagnostics extension (WAD)
C. the Windows VM agent
Show Answer
Correct Answer: A
Explanation: The Azure Monitor agent (AMA) is the supported agent for collecting performance counters, all Windows events, and all security events from Windows VMs. Using Data Collection Rules, AMA can send the same data to multiple Log Analytics workspaces simultaneously, meeting the requirement to ingest logs into both Workspace1 and Workspace2. The Windows Azure Diagnostics extension sends data primarily to storage accounts, and the Windows VM agent is only a prerequisite component, not a monitoring solution.
Question 172
You have an Azure subscription.
You plan to deploy the Azure container instances shown in the following table.
Which instances can you deploy to a container group?
A. Instance1 only
B. Instance2 only
C. Instance1 and Instance2 only
D. Instance3 and Instance4 only
Show Answer
Correct Answer: D
Explanation: Azure Container Instances support multi-container *container groups* only for Linux containers. Windows containers can be deployed only as a single container instance, not as part of a multi-container group. Therefore, only the Linux-based instances (Instance3 and Instance4) can be deployed to a container group.
Question 173
You have an Azure subscription that contains the resources shown in the following table.
All the resources connect to a virtual network named VNet1.
You plan to deploy an Azure Bastion host named Bastion1 to VNet1.
Which resources can be protected by using Bastion1?
A. VM1 only
B. contoso.com only
C. App1 and contoso.com only
D. VM1 and contoso.com only
E. VM1, App1, and contoso.com
Show Answer
Correct Answer: A
Explanation: Azure Bastion provides secure RDP and SSH access to virtual machines in a virtual network. It is used only to manage VMs without exposing public RDP/SSH ports. It does not apply to PaaS resources such as Azure App Service (App1) or a domain name like contoso.com. Therefore, only VM1 can be protected using Bastion1.
Question 174
You have an Azure subscription named Subscription1 that contains a virtual network named VNet1. VNet1 is in a resource group named RG1.
Subscription1 has a user named User1. User1 has the following roles:
• Reader
• Security Admin
• Security Reader
You need to ensure that User1 can assign the Reader role for VNet1 to other users.
What should you do?
A. Assign User1 the Network Contributor role for VNet1.
B. Remove User1 from the Security Reader role for Subscription1. Assign User1 the Contributor role for RG1.
C. Assign User1 the Owner role for VNet1.
D. Assign User1 the Network Contributor role for RG1.
Show Answer
Correct Answer: C
Explanation: To assign Azure RBAC roles, a user must have permission to create role assignments (Microsoft.Authorization/roleAssignments/write). Among the given options, only the Owner role includes this permission. Network Contributor does not allow role assignment, and Security roles are unrelated to RBAC assignment. Therefore, assigning User1 the Owner role at the scope of VNet1 enables User1 to assign the Reader role for that virtual network.
$19
Get all 558 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
