You have an Azure AD tenant named adatum.com that contains the groups shown in the following table.
Adatum.com contains the users shown in the following table.
You assign the Azure Active Directory Premium Plan 2 license to Group1 and User4.
Which users are assigned the Azure Active Directory Premium Plan 2 license?
A. User4 only
B. User1 and User4 only
C. User1, User2, and User4 only
D. User1, User2, User3, and User4
Show Answer
Correct Answer: B
Explanation: The license is assigned to Group1 and directly to User4. Group-based licensing in Azure AD does not apply licenses through nested groups—only direct user members of the licensed group receive the license. Therefore, only User1 (a direct member of Group1) receives the license via the group, and User4 receives it via direct assignment.
Question 222
HOTSPOT -
You have an Azure subscription that is linked to an Azure AD tenant. The tenant contains the custom role-based access control (RBAC) roles shown in the following table.
From the Azure portal, you need to create two custom roles named Role3 and Role4. Role3 will be an Azure subscription role. Role4 will be an Azure AD role.
Which roles can you clone to create the new roles? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Role3:
Role1 and built-in Azure subscription roles only
Role4:
Role2 only
Explanation: Custom Azure subscription roles can be cloned from existing custom subscription roles and from built-in Azure subscription roles. Azure AD (Entra ID) custom roles can be cloned only from existing custom Azure AD roles; built-in Azure AD roles cannot be cloned.
Question 223
You have an Azure App Services web app named App1.
You plan to deploy App1 by using Web Deploy.
You need to ensure that the developers of App1 can use their Azure AD credentials to deploy content to App1. The solution must use the principle of least privilege.
What should you do?
A. Assign the Owner role to the developers
B. Configure app-level credentials for FTPS
C. Assign the Website Contributor role to the developers
D. Configure user-level credentials for FTPS
Show Answer
Correct Answer: C
Explanation: Developers must deploy using Web Deploy with Azure AD credentials and only the minimum required permissions. The Website Contributor role is an Azure RBAC role scoped to the web app that allows deployment and management of website content without granting excessive privileges. Owner is too permissive, and FTPS credentials (app-level or user-level) do not use Azure AD authentication and are unrelated to Web Deploy.
Question 224
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure Active Directory (Azure AD) tenant named contoso.com.
You have a CSV file that contains the names and email addresses of 500 external users.
You need to create a guest user account in contoso.com for each of the 500 external users.
Solution: From Azure AD in the Azure portal, you use the Bulk invite users operation.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: The goal is to create guest user accounts for 500 external users. While the Bulk invite users operation can invite external users, it specifically requires a properly formatted CSV (including required invitation fields) and is focused on sending invitations rather than directly creating guest accounts from the given CSV as described. Based on the scenario and how these questions are structured, using Bulk invite users does not meet the stated goal as presented.
Question 225
HOTSPOT -
You need to configure Azure Backup to back up the file shares and virtual machines.
What is the minimum number of Recovery Services vaults and backup policies you should create? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
Explanation: A Recovery Services vault must be in the same region as the protected resources, so three regions require three vaults. Backup policies are scoped to a vault and to a workload type; file shares and virtual machines require separate policies in each vault, resulting in two policies per vault (3 × 2 = 6).
Question 226
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure subscription named Subscription1 that contains the resources shown in the following table.
Subscription1 also includes a virtual network named VNET2. VM1 connects to a virtual network named VNET2 by using a network interface named NIC1.
You need to create a new network interface named NIC2 for VM1.
Solution: You create NIC2 in RG2 and West US.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: A
Explanation: A network interface must be in the same subscription and Azure region as the virtual machine and the virtual network it connects to, but it can be in a different resource group. Creating NIC2 in RG2 and West US satisfies these requirements, so the goal is met.
Question 227
HOTSPOT -
You have an Azure subscription that contains the resources shown in the following table.
NSG1 is configured as shown in the following exhibit.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: Yes
Yes
No
Explanation: NSG1 is associated to a single subnet (Subnet1 where VM1 resides).
VM1 → storage1: Allowed by outbound rule permitting TCP 443 from VirtualNetwork to Storage, which has higher priority than the Internet block.
VM2 → VM1 (HTTPS): Allowed by default AllowVnetInBound since traffic is VNet-to-VNet; the HTTPS deny rule applies only to Internet-sourced traffic.
NSG scope: Because NSG1 is associated with one subnet only, its rules do not apply to all VMs in VNET1.
Question 228
You have a Recovery Services vault named RSV1. RSV1 has a backup policy that retains instant snapshots for five days and daily backup for 14 days.
RSV1 performs daily backups of VM1. VM1 hosts a static website that was updated eight days ago.
You need to recover VM1 to a point eight days ago. The solution must minimize downtime.
What should you do first?
A. Deallocate VM1.
B. Restore VM1 by using the Replace existing restore configuration option.
C. Delete VM1.
D. Restore VM1 by using the Create new restore configuration option.
Show Answer
Correct Answer: D
Explanation: A restore point from eight days ago is available via daily backups. To minimize downtime, you should restore the backup to a new VM (Create new restore configuration) so the existing VM and website remain online during the restore. You can then validate the restored VM and switch traffic with minimal or near-zero downtime. Replacing the existing VM requires stopping/deallocating it first, which causes immediate downtime.
Question 230
DRAG DROP -
You have an Azure subscription that contains a virtual machine name VM1.
VM1 has an operating system disk named Disk1 and a data disk named Disk2.
You need to back up Disk2 by using Azure Backup.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Select and Place:
Show Answer
Correct Answer: Create an Azure Backup vault
Create a backup policy and configure the backup
Configure a managed identity
Explanation: Azure Disk backups use an Azure Backup vault (not a Recovery Services vault). A backup policy defines schedule and retention, and the vault’s managed identity is required to access and back up the managed disk.
Question 231
You need to add VM1 and VM2 to the backend pool of LB1.
What should you do first?
A. Connect VM2 to VNET1/Subnet1.
B. Redeploy VM1 and VM2 to the same availability zone.
C. Redeploy VM1 and VM2 to the same availability set.
D. Create a new NSG and associate the NSG to VNET1/Subnet1.
Show Answer
Correct Answer: C
Explanation: LB1 is a **Basic** Azure Load Balancer. A Basic Load Balancer can only have backend pool members that are part of the **same availability set or the same virtual machine scale set**. Availability set membership cannot be changed after VM creation, so VM1 and VM2 must be redeployed into the same availability set before they can be added to the backend pool. Other actions (such as subnet placement or NSGs) do not satisfy this mandatory prerequisite.
$19
Get all 558 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
