HOTSPOT -
You need to configure Azure Backup to back up the file shares and virtual machines.
What is the minimum number of Recovery Services vaults and backup policies you should create? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
Explanation: A Recovery Services vault must be in the same region as the protected resources, so one vault is needed per region (3 total). Backup policies are specific to the protected workload type (Azure VM vs Azure Files), so each vault requires one VM policy and one Azure Files policy, giving 2 policies × 3 vaults = 6.
Question 222
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure subscription named Subscription1 that contains the resources shown in the following table.
Subscription1 also includes a virtual network named VNET2. VM1 connects to a virtual network named VNET2 by using a network interface named NIC1.
You need to create a new network interface named NIC2 for VM1.
Solution: You create NIC2 in RG2 and West US.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: A
Explanation: A network interface must be in the same subscription and region as the virtual machine and the virtual network it connects to, but it can be placed in a different resource group. Creating NIC2 in RG2 and West US satisfies those requirements assuming VM1 and VNET2 are in West US.
Question 223
HOTSPOT -
You have an Azure subscription that contains the resources shown in the following table.
NSG1 is configured as shown in the following exhibit.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: Yes
Yes
No
Explanation: NSG1 is associated with only one subnet (inferred to be subnet1 containing VM1). The outbound rule explicitly allows Storage over TCP 443, so VM1 can access the storage account. The inbound deny rule blocks HTTPS only from the Internet to VM1; traffic from VM2 within the same virtual network is allowed by the default AllowVnetInBound rule. The NSG does not apply to every VM in VNET1 because it is associated with only one subnet, not the entire VNet.
Question 224
You have a Recovery Services vault named RSV1. RSV1 has a backup policy that retains instant snapshots for five days and daily backup for 14 days.
RSV1 performs daily backups of VM1. VM1 hosts a static website that was updated eight days ago.
You need to recover VM1 to a point eight days ago. The solution must minimize downtime.
What should you do first?
A. Deallocate VM1.
B. Restore VM1 by using the Replace existing restore configuration option.
C. Delete VM1.
D. Restore VM1 by using the Create new restore configuration option.
Show Answer
Correct Answer: D
Explanation: The required recovery point is 8 days old, so it comes from the retained daily backups rather than the 5-day instant snapshots. To minimize downtime, first restore the recovery point as a new VM using the Create new restore configuration. This allows the existing VM to continue serving the website while the restored VM is validated, with cutover performed afterward. Replacing the existing VM requires stopping/deallocating it during restore, causing immediate downtime.
Sources:
https://azure.microsoft.com/en-us/blog/instantly-restore-your-azure-virtual-machines-using-azure-backup
Question 226
DRAG DROP -
You have an Azure subscription that contains a virtual machine name VM1.
VM1 has an operating system disk named Disk1 and a data disk named Disk2.
You need to back up Disk2 by using Azure Backup.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Select and Place:
Show Answer
Correct Answer: Create an Azure Backup vault
Create a backup policy and configure the backup
Configure a managed identity
Explanation: Azure Disk Backup for managed disks uses an Azure Backup vault (not a Recovery Services vault). You then create the backup policy and enable backup for the disk. The Backup vault requires a managed identity to access the disk and related resources for backup operations.
Question 227
You need to add VM1 and VM2 to the backend pool of LB1.
What should you do first?
A. Connect VM2 to VNET1/Subnet1.
B. Redeploy VM1 and VM2 to the same availability zone.
C. Redeploy VM1 and VM2 to the same availability set.
D. Create a new NSG and associate the NSG to VNET1/Subnet1.
Show Answer
Correct Answer: C
Explanation: For a Basic Azure Load Balancer, backend pool members must be virtual machines in the same availability set or the same virtual machine scale set. Existing VMs cannot be moved into an availability set after creation, so they must be redeployed into the same availability set before they can be added to the Basic Load Balancer backend pool. Being in the same subnet is not a strict requirement for Basic Load Balancer backend membership as long as the VMs are in the same virtual network.
Question 228
You need to identify which storage account to use for the flow logging of IP traffic from VM5. The solution must meet the retention requirements.
Which storage account should you identify?
A. storage1
B. storage2
C. storage3
D. storage4
Show Answer
Correct Answer: B
Explanation: NSG flow log retention is supported only with General-purpose v2 (GPv2) storage accounts. Based on the scenario, storage2 is the GPv2 account that satisfies the retention requirement, making it the appropriate choice.
Question 229
You need to ensure that you can grant Group4 Azure RBAC read only permissions to all the Azure file shares.
What should you do?
A. On storage2, enable identity-based access for the file shares.
B. Recreate storage2 and set Hierarchical namespace to Enabled.
C. On storage1 and storage4, change the Account kind type to StorageV2 (general purpose v2).
D. Create a shared access signature (SAS) for storage1, storage2, and storage4.
Show Answer
Correct Answer: A
Explanation: Azure RBAC for Azure Files share-level access requires identity-based access to be enabled on the storage account. Enabling identity-based access on storage2 allows assigning Azure RBAC read-only permissions to the Azure file shares. Hierarchical namespace is for Data Lake Storage Gen2, changing account kind is not the required action for this scenario, and SAS tokens are not Azure RBAC.
Question 230
HOTSPOT -
You implement the planned changes for NSG1 and NSG2.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: Yes
Yes
No
Explanation: NSG1 contains custom inbound rules, while NSG2 contains custom outbound rules. RDP from VM1 to VM2 is not blocked by NSG2 because it applies to outbound traffic from the subnet containing VM2. ICMP traffic from VM2 to VM3 is allowed by default over peered virtual networks. Outbound RDP from VM2 is blocked by the custom outbound deny rule in NSG2.
Question 231
You have an Azure Active Directory (Azure AD) tenant that is linked to 10 Azure subscriptions.
You need to centrally monitor user activity across all the subscriptions.
What should you use?
A. Azure Application Insights Profiler
B. access reviews
C. Activity log filters
D. a Log Analytics workspace
Show Answer
Correct Answer: D
Explanation: A Log Analytics workspace provides centralized collection and querying of Azure Activity Logs and other diagnostic data across multiple Azure subscriptions. By configuring each subscription to send its activity logs to a single workspace, you can monitor user activity across all subscriptions from one place. Application Insights Profiler is for application performance, access reviews are for governance of access, and activity log filters operate on subscription activity logs but do not provide centralized cross-subscription monitoring by themselves.
$19
Get all 555 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
