HOTSPOT -
You have an Azure App Service app named WebApp1 that contains two folders named Folder1 and Folder2.
You need to configure a daily backup of WebApp1. The solution must ensure that Folder2 is excluded from the backup.
What should you create first, and what should you use to exclude Folder2? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: First create:
An Azure Storage account
To exclude Folder2, use:
A _backup.filter file
Explanation: Azure App Service custom backups are stored in an Azure Storage account, not a Backup or Recovery Services vault. To exclude specific folders from App Service backups, you create a _backup.filter file in the app’s wwwroot directory and list the folders to omit, such as Folder2.
Question 244
HOTSPOT -
You have the following custom role-based access control (RBAC) role.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: No
Yes
Yes
Explanation: Assigning roles requires Microsoft.Authorization/*/write, which is explicitly excluded by notActions.
Deploying VMs is allowed by Microsoft.Compute/virtualMachines/* and Microsoft.Resources/deployments/*.
Setting a static IP is allowed via Microsoft.Network/networkInterfaces/* (NIC IP configuration).
Question 245
You create an Azure Storage account.
You plan to add 10 blob containers to the storage account.
For one of the containers, you need to use a different key to encrypt data at rest.
What should you do before you create the container?
A. Generate a shared access signature (SAS).
B. Modify the minimum TLS version.
C. Rotate the access keys.
D. Create an encryption scope.
Show Answer
Correct Answer: D
Explanation: Azure Blob Storage uses a single encryption key by default for the entire storage account. To encrypt one specific container with a different key, you must define an encryption scope. An encryption scope allows you to associate a customer-managed or Microsoft-managed key with a specific container (or individual blobs). The encryption scope must exist before the container is created so it can be applied as the container’s default encryption setting.
Question 246
You are configuring Azure Active Directory (Azure AD) authentication for an Azure Storage account named storage1.
You need to ensure that the members of a group named Group1 can upload files by using the Azure portal. The solution must use the principle of least privilege.
Which two roles should you configure for storage1? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
A. Storage Account Contributor
B. Storage Blob Data Contributor
C. Reader
D. Contributor
E. Storage Blob Data Reader
Show Answer
Correct Answer: B, C
Explanation: To upload files via the Azure portal using Azure AD authentication, users need both data-plane and minimal control-plane access. **Storage Blob Data Contributor** grants the required read/write permissions to upload blobs (least-privileged data role). However, by itself it does not allow users to browse the storage account in the Azure portal. The **Reader** role provides read-only access to the storage account resources so users can navigate the portal without granting management permissions. Together, these satisfy the requirement with least privilege.
Question 247
You have an Azure subscription that contains a storage account named storage1.
You have the devices shown in the following table.
From which devices can you use AzCopy to copy data to storage1?
A. Device 1 only
B. Device1, Device2 and Device3
C. Device1 and Device2 only
D. Device1 and Device3 only
Show Answer
Correct Answer: B
Explanation: AzCopy v10 is a cross-platform command-line tool supported on Windows, Linux, and macOS. Since the listed devices run these supported operating systems, you can use AzCopy from Device1, Device2, and Device3 to copy data to the Azure Storage account.
Question 248
You develop the following Azure Resource Manager (ARM) template to create a resource group and deploy an Azure Storage account to the resource group.
Which cmdlet should you run to deploy the template?
A. New-AzResource
B. New-AzResourceGroupDeployment
C. New-AzTenantDeployment
D. New-AzDeployment
Show Answer
Correct Answer: D
Explanation: The template creates a resource group and then deploys a storage account into it. Creating a resource group is a subscription-scope operation, so the ARM template must be deployed at the subscription scope. New-AzDeployment runs a deployment at the subscription level, whereas New-AzResourceGroupDeployment requires an existing resource group.
Question 249
DRAG DROP -
You have an Azure subscription that contains the storage accounts shown in the following table.
You plan to use AzCopy to copy a blob from container1 directly to share1.
You need to identify which authentication method to use when you use AzCopy.
What should you identify for each account? To answer, drag the appropriate authentication methods to the correct accounts. Each method may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Select and Place:
Show Answer
Correct Answer: storage1: A shared access signature (SAS) token
storage2: A shared access signature (SAS) token
Explanation: AzCopy requires a SAS token when copying from Azure Blob Storage to Azure Files. Azure Files does not support OAuth/Azure AD authentication with AzCopy, so the destination must use SAS. When copying a blob to a file share, a SAS is also required for the source, even though Blob Storage supports Azure AD authentication.
Question 250
You have a subnet named Subnet1 that contains Azure virtual machines. A network security group (NSG) named NSG1 is associated to Subnet1. NSG1 only contains the default rules.
You need to create a rule in NSG1 to prevent the hosts on Subnet1 form connecting to the Azure portal. The hosts must be able to connect to other internet hosts.
To what should you set Destination in the rule?
A. Application security group
B. IP Addresses
C. Service Tag
D. Any
Show Answer
Correct Answer: C
Explanation: To block access specifically to the Azure portal while still allowing access to other internet destinations, the NSG rule must target a predefined group of Azure-managed IP prefixes. This is exactly what a Service Tag provides. Azure service tags (such as AzurePortal/AzureCloud–as intended by the exam) represent Microsoft‑maintained address ranges for Azure services and are designed to be used as the Destination in NSG rules. Using IP addresses would be impractical due to frequent changes, and the other options do not scope traffic to Azure portal endpoints.
Question 251
You have two Azure subscriptions named Sub1 and Sub2.
An administrator creates a custom role that has an assignable scope to a resource group named RG1 in Sub1.
You need to ensure that you can apply the custom role to any resource group in Sub1 and Sub2. The solution must minimize administrative effort.
What should you do?
A. Select the custom role and add Sub1 and Sub2 to the assignable scopes. Remove RG1 from the assignable scopes.
B. Create a new custom role for Sub1. Create a new custom role for Sub2. Remove the role from RG1.
C. Create a new custom role for Sub1 and add Sub2 to the assignable scopes. Remove the role from RG1.
D. Select the custom role and add Sub1 to the assignable scopes. Remove RG1 from the assignable scopes. Create a new custom role for Sub2.
Show Answer
Correct Answer: A
Explanation: A custom role’s assignable scopes determine where it can be assigned. To use the same role on any resource group in both Sub1 and Sub2 with minimal effort, update the existing role by removing the narrow RG1 scope and adding the broader subscription scopes for Sub1 and Sub2. This avoids creating or managing additional roles while enabling assignment to any resource group in both subscriptions.
Question 252
You have 15 Azure subscriptions.
You have an Azure Active Directory (Azure AD) tenant that contains a security group named Group1.
You plan to purchase additional Azure subscription.
You need to ensure that Group1 can manage role assignments for the existing subscriptions and the planned subscriptions. The solution must meet the following requirements:
✑ Use the principle of least privilege.
✑ Minimize administrative effort.
What should you do?
A. Assign Group1 the Owner role for the root management group.
B. Assign Group1 the User Access Administrator role for the root management group.
C. Create a new management group and assign Group1 the User Access Administrator role for the group.
D. Create a new management group and assign Group1 the Owner role for the group.
Show Answer
Correct Answer: B
Explanation: Group1 needs to manage role assignments across all existing and future subscriptions while following least privilege and minimizing effort. Assigning the User Access Administrator role grants exactly the required permission (manage role assignments) without broader resource control, unlike Owner. Assigning it at the root management group ensures it automatically applies to all current subscriptions and any new subscriptions created in the tenant, avoiding ongoing administrative work. Creating a new management group would require moving subscriptions and handling future subscriptions manually, increasing effort.
$19
Get all 558 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
