You plan to deploy several Azure virtual machines that will run Windows Server 2019 in a virtual machine scale set by using an Azure Resource Manager template.
You need to ensure that NGINX is available on all the virtual machines after they are deployed.
What should you use?
A. the Publish-AzVMDscConfiguration cmdlet
B. Azure Application Insights
C. Azure Custom Script Extension
D. a Microsoft Endpoint Manager device configuration profile
Show Answer
Correct Answer: C
Explanation: Azure Custom Script Extension is the appropriate choice for an ARM template deployment when you need to install software such as NGINX on every VM in a virtual machine scale set after provisioning. Publish-AzVMDscConfiguration only uploads a DSC configuration; by itself it does not apply it to VMs. Application Insights is for monitoring, and Microsoft Endpoint Manager device configuration profiles are not used for this VM provisioning scenario.
Question 265
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure subscription named Subscription1 that contains the resources shown in the following table.
Subscription1 also includes a virtual network named VNET2. VM1 connects to a virtual network named VNET2 by using a network interface named NIC1.
You need to create a new network interface named NIC2 for VM1.
Solution: You create NIC2 in RG2 and Central US.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: A network interface attached to an Azure virtual machine must be in the same subscription and Azure region as the VM. It must also connect to a virtual network in the same region as the NIC. Creating NIC2 in Central US would not meet the requirement if VM1 is in a different region (as implied by the scenario), so the solution does not meet the goal.
Question 266
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure subscription named Subscription1 that contains the resources shown in the following table.
Subscription1 also includes a virtual network named VNET2. VM1 connects to a virtual network named VNET2 by using a network interface named NIC1.
You need to create a new network interface named NIC2 for VM1.
Solution: You create NIC2 in RG1 and West US.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: A
Explanation: Creating the NIC in a different resource group is allowed. To attach a NIC to an existing VM, the NIC must be in the same subscription and Azure region as the VM and connected to a virtual network in that same region. The resource group does not need to match the VM's resource group. Therefore, creating NIC2 in RG1 and West US meets the stated goal.
Question 267
You have an Azure App Service web app named App1.
You need to collect performance traces for App1.
What should you use?
A. Azure Application Insights Profiler
B. the Activity log
C. the Deployment center
D. the Diagnose and solve problems settings
Show Answer
Correct Answer: A
Explanation: Azure Application Insights Profiler is designed to capture and analyze performance traces for Azure App Service applications. The Activity log records Azure resource management events, Deployment Center manages deployments, and Diagnose and solve problems assists with troubleshooting but is not the primary tool for collecting performance traces.
Question 268
HOTSPOT -
You have an Azure subscription that contains the resources shown in the following table:
You assign a policy to RG6 as shown in the following table:
To RG6, you apply the tag: RGroup: RG6.
You deploy a virtual network named VNET2 to RG6.
Which tags apply to VNET1 and VNET2? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: VNET1: Department: D1 only
VNET2: Label: Value1 only
Explanation: Resource group tags are not inherited by resources. The policy applies to resources created after the assignment and does not retroactively tag existing resources without remediation. Therefore, the existing VNET1 keeps only its original tag, while the newly created VNET2 receives only the policy-added Label=Value1 tag.
Question 269
HOTSPOT -
You have an Azure Active Directory (Azure AD) tenant named contoso.com that contains the users shown in the following table:
User3 is the owner of Group1.
Group2 is a member of Group1.
You configure an access review named Review1 as shown in the following exhibit:
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: No
No
Yes
Explanation: The access review is scoped to guest users only for Group1, with group owners as reviewers. User1 and UserA are member-type users, so they are not reviewed. Nested group membership is flattened for group access reviews, so guest UserB from Group2 (nested in Group1) is included and can be reviewed by Group1's owner, User3.
Question 270
HOTSPOT -
You have Azure Active Directory tenant named Contoso.com that includes following users:
Contoso.com includes following Windows 10 devices:
You create following security groups in Contoso.com:
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: No
Yes
No
Explanation: User1 is a Cloud Device Administrator, which can manage device state but not group membership. User2 is the owner of the assigned group, so can add a device to Group1. Group2 is a dynamic device group, so membership is rule-based and cannot be changed manually.
Question 271
You have a Microsoft 365 tenant and an Azure Active Directory (Azure AD) tenant named contoso.com.
You plan to grant three users named User1, User2, and User3 access to a temporary Microsoft SharePoint document library named Library1.
You need to create groups for the users. The solution must ensure that the groups are deleted automatically after 180 days.
Which two groups should you create? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
A. a Microsoft 365 group that uses the Assigned membership type
B. a Security group that uses the Assigned membership type
C. a Microsoft 365 group that uses the Dynamic User membership type
D. a Security group that uses the Dynamic User membership type
E. a Security group that uses the Dynamic Device membership type
Show Answer
Correct Answer: A, C
Explanation: Group expiration policies in Microsoft Entra ID (Azure AD) apply to Microsoft 365 groups, not security groups. Both assigned-membership and dynamic user-membership Microsoft 365 groups can be used to grant SharePoint access, and the group itself can be governed by a 180-day expiration policy. Security groups (assigned or dynamic) do not support Microsoft 365 group expiration policies.
Question 273
HOTSPOT -
You have an Azure subscription named Subscription1 that contains a resource group named RG1.
In RG1, you create an internal load balancer named LB1 and a public load balancer named LB2.
You need to ensure that an administrator named Admin1 can manage LB1 and LB2. The solution must follow the principle of least privilege.
Which role should you assign to Admin1 for each task? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: To add a backend pool to LB1: Network Contributor on LB1
To add a health probe to LB2: Network Contributor on LB2
Explanation: Network Contributor is the least-privileged built-in role for managing load balancer configuration. Assigning it directly on each load balancer limits access to only the required resource, unlike assigning it at the resource group level.
Question 274
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure subscription that contains the following users in an Azure Active Directory tenant named contoso.onmicrosoft.com:
User1 creates a new Azure Active Directory tenant named external.contoso.onmicrosoft.com.
You need to create new user accounts in external.contoso.onmicrosoft.com.
Solution: You instruct User4 to create the user accounts.
Does that meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: Creating a new Microsoft Entra ID (Azure AD) tenant makes the creator the initial Global Administrator of that new tenant. Other users from the original tenant, including User4, do not automatically have administrative rights in the new tenant. Unless User1 first invites and assigns User4 an appropriate directory role (such as Global Administrator or User Administrator), User4 cannot create user accounts in the new tenant.
$19
Get all 555 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
