You need to configure an Azure web app named contoso.azurewebsites.net to host www.contoso.com.
What should you do first?
A. Create A records named www.contoso.com and asuid.contoso.com.
B. Create a TXT record named asuid that contains the domain verification ID.
C. Create a CNAME record named asuid that contains the domain verification ID.
D. Create a TXT record named www.contoso.com that has a value of contoso.azurewebsites.net.
Show Answer
Correct Answer: B
Explanation: Before mapping the custom hostname to the Azure App Service, Azure requires verification of domain ownership. The first step is to create a TXT record named 'asuid' containing the domain verification ID. After verification, you create the appropriate CNAME (for a subdomain like www) or A record (for a root domain) to complete the mapping.
Question 212
You have an Azure subscription that contains eight virtual machines and the resources shown in the following table.
You need to configure access for VNET1. The solution must meet the following requirements:
• The virtual machines connected to VNET1 must be able to communicate with the virtual machines connected to VNET2 by using the Microsoft backbone.
• The virtual machines connected to VNET1 must be able to access storage1, storage2, and Azure AD by using the Microsoft backbone.
What is the minimum number of service endpoints you should add to VNET1?
A. 1
B. 2
C. 3
D. 5
Show Answer
Correct Answer: A
Explanation: VM-to-VM communication between VNET1 and VNET2 uses virtual network peering (or equivalent networking), not service endpoints. A single Microsoft.Storage service endpoint on VNET1 enables private backbone access to both storage accounts because service endpoints are configured per Azure service, not per storage account. General Microsoft Entra ID (Azure AD) access does not require a virtual network service endpoint; the Microsoft.AzureActiveDirectory service endpoint is a specialized tag and is not used for general Entra ID connectivity.
Sources:
https://learn.microsoft.com/en-us/answers/questions/5573500/accessing-vms-in-multiple-resource-groups-via-a-si
Question 213
You have an Azure subscription named Subscription1 that contains an Azure Log Analytics workspace named Workspace1.
You need to view the error events from a table named Event.
Which query should you run in Workspace1?
A. select * from Event where EventType == "error"
B. Event | search "error"
C. Event | where EventType is "error"
D. Get-Event Event | where {$_.EventType == "error"}
Show Answer
Correct Answer: B
Explanation: Azure Log Analytics uses Kusto Query Language (KQL), not SQL or PowerShell. 'Event | search "error"' is valid KQL syntax to search the Event table for the term 'error'. Option A is SQL syntax, C uses invalid KQL syntax ('is' instead of '=='), and D is PowerShell, not a Log Analytics workspace query.
Question 214
You have an Azure subscription that contains the storage accounts shown in the following table.
You deploy a web app named App1 to the West US Azure region.
You need to back up App1. The solution must minimize costs.
Which storage account should you use as the target for the backup?
A. storage1
B. storage2
C. storage3
D. storage4
Show Answer
Correct Answer: B
Explanation: App Service backups should target a storage account in the same region to avoid unnecessary data transfer costs. With App1 in West US, the viable choices are the West US storage accounts. Between them, the standard BlobStorage account is the lower-cost option compared with a premium BlockBlobStorage account, so it best satisfies the requirement to minimize costs.
Question 215
You have an Azure subscription named Subscription1.
You have 5 TB of data that you need to transfer to Subscription1.
You plan to use an Azure Import/Export job.
What can you use as the destination of the imported data?
A. an Azure Cosmos DB database
B. Azure File Storage
C. Azure SQL Database
D. a virtual machine
Show Answer
Correct Answer: B
Explanation: Azure Import/Export supports importing data into Azure Blob storage and Azure Files. Among the given options, only Azure File Storage is a supported import destination. It cannot import directly into Azure Cosmos DB, Azure SQL Database, or a virtual machine.
Question 216
HOTSPOT
-
You have an Azure AD user named User1 and a read-access geo-redundant storage (RA-GRS) account named contoso2023.
You need to meet the following requirements:
• User1 must be able to write blob data to contoso2023.
• The contoso2023 account must fail over to its secondary endpoint.
Which two settings should you configure? To answer, select the appropriate settings in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Access Control (IAM)
Geo-replication (Redundancy)
Explanation: Grant User1 the Storage Blob Data Contributor role through IAM to allow blob writes. Use the Geo-replication/Redundancy settings to initiate or configure account failover to the secondary region for an RA-GRS storage account.
Question 217
You have an Azure AD tenant named adatum.com that contains the groups shown in the following table.
Adatum.com contains the users shown in the following table.
You assign the Azure Active Directory Premium Plan 2 license to Group1 and User4.
Which users are assigned the Azure Active Directory Premium Plan 2 license?
A. User4 only
B. User1 and User4 only
C. User1, User2, and User4 only
D. User1, User2, User3, and User4
Show Answer
Correct Answer: B
Explanation: Group-based licensing in Azure AD (Microsoft Entra ID) does not process nested group membership. When the license is assigned to Group1, only its direct user members receive it. Based on the described hierarchy, only User1 is a direct user member of Group1, while users in nested groups do not inherit the license through group nesting. User4 also receives the license because it is assigned directly.
Question 218
HOTSPOT -
You have an Azure subscription that is linked to an Azure AD tenant. The tenant contains the custom role-based access control (RBAC) roles shown in the following table.
From the Azure portal, you need to create two custom roles named Role3 and Role4. Role3 will be an Azure subscription role. Role4 will be an Azure AD role.
Which roles can you clone to create the new roles? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Role3: Role1 and built-in Azure subscription roles only
Role4: Role2 only
Explanation: Azure RBAC custom roles can be cloned from custom or built-in Azure subscription roles. Microsoft Entra (Azure AD) custom roles can be cloned from existing custom Entra roles, but built-in Entra roles cannot be cloned in the portal.
Question 219
You have an Azure App Services web app named App1.
You plan to deploy App1 by using Web Deploy.
You need to ensure that the developers of App1 can use their Azure AD credentials to deploy content to App1. The solution must use the principle of least privilege.
What should you do?
A. Assign the Owner role to the developers
B. Configure app-level credentials for FTPS
C. Assign the Website Contributor role to the developers
D. Configure user-level credentials for FTPS
Show Answer
Correct Answer: C
Explanation: Web Deploy can use Azure AD/RBAC authorization, whereas FTPS credentials are separate deployment credentials and do not use Azure AD identities. The Website Contributor built-in role grants the permissions needed to manage and deploy to the web app without the excessive privileges of the Owner role, satisfying the principle of least privilege.
Question 220
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure Active Directory (Azure AD) tenant named contoso.com.
You have a CSV file that contains the names and email addresses of 500 external users.
You need to create a guest user account in contoso.com for each of the 500 external users.
Solution: From Azure AD in the Azure portal, you use the Bulk invite users operation.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: A
Explanation: Yes. The Azure AD (Microsoft Entra ID) Bulk invite users operation is the built-in feature for creating guest user accounts from a CSV of external users. Even if the existing CSV contains only names and email addresses, the bulk invite workflow uses a CSV template that can be populated before upload, so this approach meets the stated goal.
$19
Get all 555 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
