You have an Azure subscription that contains a storage account named storage1.
You have the devices shown in the following table.
From which devices can you use AzCopy to copy data to storage1?
A. Device 1 only
B. Device1, Device2 and Device3
C. Device1 and Device2 only
D. Device1 and Device3 only
Show Answer
Correct Answer: B
Explanation: AzCopy v10 is supported on Windows, Linux, and macOS. Therefore, if Device1, Device2, and Device3 correspond to those supported operating systems, you can use AzCopy from all three devices to copy data to the Azure Storage account.
Question 244
You develop the following Azure Resource Manager (ARM) template to create a resource group and deploy an Azure Storage account to the resource group.
Which cmdlet should you run to deploy the template?
A. New-AzResource
B. New-AzResourceGroupDeployment
C. New-AzTenantDeployment
D. New-AzDeployment
Show Answer
Correct Answer: D
Explanation: If the ARM template creates a resource group and then deploys a storage account into it, the deployment scope is the subscription because resource groups are subscription-level resources. Subscription-scope deployments are executed with New-AzDeployment (formerly New-AzSubscriptionDeployment). New-AzResourceGroupDeployment is used only when deploying into an already existing resource group.
Question 245
DRAG DROP -
You have an Azure subscription that contains the storage accounts shown in the following table.
You plan to use AzCopy to copy a blob from container1 directly to share1.
You need to identify which authentication method to use when you use AzCopy.
What should you identify for each account? To answer, drag the appropriate authentication methods to the correct accounts. Each method may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Select and Place:
Show Answer
Correct Answer: storage1: A shared access signature (SAS) token
storage2: A shared access signature (SAS) token
Explanation: For AzCopy blob-to-Azure Files copy, the supported authentication for Azure Files is SAS, and Microsoft documentation requires SAS for blob-to-file copy scenarios. Anonymous is unavailable because the blob container is not public.
Question 246
You have a subnet named Subnet1 that contains Azure virtual machines. A network security group (NSG) named NSG1 is associated to Subnet1. NSG1 only contains the default rules.
You need to create a rule in NSG1 to prevent the hosts on Subnet1 form connecting to the Azure portal. The hosts must be able to connect to other internet hosts.
To what should you set Destination in the rule?
A. Application security group
B. IP Addresses
C. Service Tag
D. Any
Show Answer
Correct Answer: C
Explanation: The intended exam answer is Service Tag. NSG rules support service tags as the Destination to represent Azure service IP ranges instead of manually maintaining IP addresses. Although there have been practical limitations and inconsistencies around blocking Azure portal access specifically with certain service tags, Microsoft certification questions typically expect using a Service Tag rather than IP addresses or Any.
Question 247
You have two Azure subscriptions named Sub1 and Sub2.
An administrator creates a custom role that has an assignable scope to a resource group named RG1 in Sub1.
You need to ensure that you can apply the custom role to any resource group in Sub1 and Sub2. The solution must minimize administrative effort.
What should you do?
A. Select the custom role and add Sub1 and Sub2 to the assignable scopes. Remove RG1 from the assignable scopes.
B. Create a new custom role for Sub1. Create a new custom role for Sub2. Remove the role from RG1.
C. Create a new custom role for Sub1 and add Sub2 to the assignable scopes. Remove the role from RG1.
D. Select the custom role and add Sub1 to the assignable scopes. Remove RG1 from the assignable scopes. Create a new custom role for Sub2.
Show Answer
Correct Answer: A
Explanation: Custom Azure RBAC roles can have multiple assignable scopes, including multiple subscriptions within the same Microsoft Entra tenant. Expanding the existing role's assignable scopes from the single resource group (RG1) to both subscription scopes (Sub1 and Sub2) allows the role to be assigned to any resource group in either subscription while avoiding the creation and maintenance of duplicate custom roles. Removing the resource-group-only scope is appropriate once the broader subscription scopes are added.
Question 248
You have 15 Azure subscriptions.
You have an Azure Active Directory (Azure AD) tenant that contains a security group named Group1.
You plan to purchase additional Azure subscription.
You need to ensure that Group1 can manage role assignments for the existing subscriptions and the planned subscriptions. The solution must meet the following requirements:
✑ Use the principle of least privilege.
✑ Minimize administrative effort.
What should you do?
A. Assign Group1 the Owner role for the root management group.
B. Assign Group1 the User Access Administrator role for the root management group.
C. Create a new management group and assign Group1 the User Access Administrator role for the group.
D. Create a new management group and assign Group1 the Owner role for the group.
Show Answer
Correct Answer: B
Explanation: Assign Group1 the User Access Administrator role at the root management group. User Access Administrator grants permission to manage role assignments without the broader resource management permissions of Owner, satisfying least privilege. Assigning it at the root management group applies to all existing subscriptions and automatically covers future subscriptions that are placed under the root management group, minimizing administrative effort.
Question 249
You have an on-premises datacenter and an Azure subscription.
You plan to connect the datacenter to Azure by using ExpressRoute.
You need to deploy an ExpressRoute gateway. The solution must meet the following requirements:
✑ Support up to 10 Gbps of traffic.
✑ Support availability zones.
✑ Support FastPath.
✑ Minimize costs.
Which SKU should you deploy?
A. ERGw1AZ
B. ERGw2
C. ErGw3
D. ErGw3AZ
Show Answer
Correct Answer: D
Explanation: The gateway must support all four requirements: up to 10 Gbps, availability zones, FastPath, and the lowest cost that satisfies those requirements. ERGw1AZ supports availability zones and FastPath but not 10 Gbps. ERGw2 lacks availability zone support. ErGw3 supports 10 Gbps but not availability zones. ErGw3AZ is the only SKU that provides 10 Gbps, availability zone support, and FastPath, making it the least expensive option that meets all stated requirements.
Question 250
You have an Azure subscription named Subscription1 that contains an Azure Log Analytics workspace named Workspace1.
You need to view the error events from a table named Event.
Which query should you run in Workspace1?
A. Get-Event Event | where {$_.EventType == "error"}
B. Event | search "error"
C. select * from Event where EventType == "error"
D. search in (Event) * | where EventType ג€"eq ג€errorג€
Show Answer
Correct Answer: B
Explanation: Azure Log Analytics uses Kusto Query Language (KQL), not PowerShell or SQL. `Event | search "error"` is valid KQL and searches the Event table for records containing the term "error". Options A and C use PowerShell and SQL syntax respectively, and D is not valid as written due to incorrect operators/syntax.
Question 251
HOTSPOT -
You have an Azure subscription that contains the hierarchy shown in the following exhibit.
You create an Azure Policy definition named Policy1.
To which Azure resources can you assign Policy1 and which Azure resources can you specify as exclusions from Policy1? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: Assign: Tenant Root Group, ManagementGroup1, Subscription1, RG1, and VM1
Exclude: ManagementGroup1, Subscription1, RG1, and VM1 only
Explanation: Azure Policy assignments support scopes from the tenant root management group down to individual resources. Exclusions (notScopes) must be within the assignment scope and cannot exclude the assignment scope itself (for example, the tenant root if assigned there).
Question 252
You have an Azure subscription that contains a storage account named storage1. The storage1 account contains a file share named share1.
The subscription is linked to a hybrid Azure Active Directory (Azure AD) tenant that contains a security group named Group1.
You need to grant Group1 the Storage File Data SMB Share Elevated Contributor role for share1.
What should you do first?
A. Enable Active Directory Domain Service (AD DS) authentication for storage1.
B. Grant share-level permissions by using File Explorer.
C. Mount share1 by using File Explorer.
D. Create a private endpoint.
Show Answer
Correct Answer: A
Explanation: To assign Azure RBAC share-level roles such as Storage File Data SMB Share Elevated Contributor to identities for SMB access in a hybrid Azure AD environment, the storage account must first be configured for Active Directory Domain Services (or Microsoft Entra Domain Services/Azure AD DS) authentication. Mounting the share, setting permissions through File Explorer, or creating a private endpoint are not prerequisite steps for enabling this authentication and RBAC-based access.
$19
Get all 555 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
