You have an Azure subscription named Subscription1 that contains a virtual network named VNet1. VNet1 is in a resource group named RG1.
Subscription1 has a user named User1. User1 has the following roles:
• Reader
• Security Admin
• Security Reader
You need to ensure that User1 can assign the Reader role for VNet1 to other users.
What should you do?
A. Remove User1 from the Security Reader role for Subscript on 1. Assign User1 the Contributor role for RG1.
B. Assign User1 the Owner role for VNet1.
C. Remove User1 from the Security Reader and Reader roles for Subscription1. Assign User1 the Contributor role for Subscription 1.
D. Assign User1 the Contributor role for VNet1.
Show Answer
Correct Answer: B
Explanation: To assign Azure RBAC roles, a user needs the Microsoft.Authorization/roleAssignments/write permission, which is included in the Owner role (and User Access Administrator), but not in Contributor, Reader, Security Reader, or Security Admin. Assigning the Owner role scoped to VNet1 gives User1 permission to assign the Reader role for that resource without granting ownership beyond that scope.
Question 160
HOTSPOT
-
You have an Azure subscription that contains a user named User1 and the resources shown in the following table.
NSG1 is associated to networkinterface1.
User1 has role assignments for NSG1 as shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Yes
No
Yes
Explanation: Storage Account Contributor at the resource group scope can create and manage storage accounts in that resource group. Contributor on the NSG allows managing NSG rules, but does not grant permission to modify the network interface's DNS settings. Therefore the user can add inbound security rules to the associated NSG but cannot change NIC DNS settings.
Question 161
You have an Azure subscription.
You need to receive an email alert when a resource lock is removed from any resource in the subscription.
What should you use to create an activity log alert in Azure Monitor?
A. a resource, a condition, and an action group
B. a resource, a condition, and a Microsoft 365 group
C. a Log Analytics workspace, a resource, and an action group
D. a data collection endpoint, an application security group, and a resource group
Show Answer
Correct Answer: A
Explanation: An Azure Monitor activity log alert rule is created by specifying the scope (resource or subscription), the activity log condition (such as administrative operation 'Delete lock' or resource lock removal), and an action group to send notifications such as email. Microsoft 365 groups, Log Analytics workspaces, data collection endpoints, and application security groups are not required components for creating an activity log alert rule.
Question 163
You have an Azure subscription named Subscription1.
You have 5 TB of data that you need to transfer to Subscription1.
You plan to use an Azure Import/Export job.
What can you use as the destination of the imported data?
A. an Azure Cosmos DB database
B. Azure Data Lake Store
C. Azure Blob storage
D. Azure Data Factory
Show Answer
Correct Answer: C
Explanation: Azure Import/Export supports importing data into Azure Blob storage (and Azure Files), not Azure Cosmos DB, Azure Data Lake Store, or Azure Data Factory. Therefore, the valid destination from the options is Azure Blob storage.
Question 164
HOTSPOT
-
You have an Azure subscription that contains a storage account named storage1. The storage1 account contains a container named container1.
You create a blob lifecycle rule named rule1.
You need to configure rule1 to automatically move blobs that were NOT updated for 45 days from contained to the Cool access tier.
How should you complete the rule? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation: The requirement is based on blobs not being updated, so use the modification time condition. Moving to the Cool tier is supported for block blobs in lifecycle management.
Question 165
You have an Azure subscription that contains a virtual machine named VM1 and an Azure function named App1.
You need to create an alert rule that will run App1 if VM1 stops.
What should you create for the alert rule?
A. an application security group
B. a security group that has dynamic device membership
C. an action group
D. an application group
Show Answer
Correct Answer: C
Explanation: Azure Monitor alert rules use action groups to define what happens when an alert is triggered. An action group can invoke an Azure Function, so to run App1 when VM1 stops, you create an action group and associate it with the alert rule.
Question 166
You have an Azure subscription that contains a storage account named storage1 in the North Europe Azure region.
You need to ensure that when blob data is added to storage1, a secondary copy is created in the East US region. The solution must minimize administrative effort.
What should you configure?
A. operational backup
B. object replication
C. geo-redundant storage (GRS)
D. a lifecycle management rule
Show Answer
Correct Answer: B
Explanation: Object replication is the only option that allows you to replicate blob data to a specifically chosen Azure region such as East US. Geo-redundant storage (GRS) automatically replicates to the storage account's paired region, which for North Europe is not East US, so it does not meet the stated requirement. Operational backup and lifecycle management do not provide cross-region blob replication.
Question 167
You have an Azure subscription that contains two Log Analytics workspaces named Workspace1 and Workspace2 and 100 virtual machines that run Windows Server.
You need to collect performance data and events from the virtual machines. The solution must meet the following requirements:
• Logs must be sent to Workspace1 and Workspace 2.
• All Windows events must be captured.
• All security events must be captured.
What should you install and configure on each virtual machine?
A. the Azure Monitor agent
B. the Windows Azure diagnostics extension (WAD)
C. the Windows VM agent
Show Answer
Correct Answer: A
Explanation: The Azure Monitor agent (AMA) is the supported agent for collecting performance counters and Windows event logs, including security events, and can be configured through Data Collection Rules to send data to multiple Log Analytics workspaces. The Windows Azure Diagnostics extension primarily sends diagnostics to Azure Storage and is not the appropriate solution for this requirement. The Windows VM agent enables VM extensions but does not itself collect and forward monitoring data.
Question 170
You have an Azure subscription named Subscription1 that contains a virtual network named VNet1. VNet1 is in a resource group named RG1.
Subscription1 has a user named User1. User1 has the following roles:
• Reader
• Security Admin
• Security Reader
You need to ensure that User1 can assign the Reader role for VNet1 to other users.
What should you do?
A. Assign User1 the Network Contributor role for VNet1.
B. Remove User1 from the Security Reader role for Subscription1. Assign User1 the Contributor role for RG1.
C. Assign User1 the Owner role for VNet1.
D. Assign User1 the Network Contributor role for RG1.
Show Answer
Correct Answer: C
Explanation: To assign Azure RBAC roles (such as the Reader role) on a resource, a user must have the Microsoft.Authorization/roleAssignments/write permission, which is included in the Owner and User Access Administrator roles. Among the provided options, only assigning the Owner role for VNet1 grants the required ability to assign RBAC roles on that virtual network. Network Contributor and Contributor cannot manage role assignments, and removing Security Reader is irrelevant.
Question 171
You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers.
You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines.
You need to ensure that visitors are serviced by the same web server for each request.
What should you configure?
A. Session persistence to None
B. a health probe
C. Session persistence to Client IP and protocol
D. Idle Time-out (minutes) to 20
Show Answer
Correct Answer: C
Explanation: Configure the Azure Load Balancer session persistence (load distribution mode) to 'Client IP and protocol' so requests from the same client are consistently directed to the same backend VM (session affinity). A health probe only determines backend availability, idle timeout controls TCP connection timeout, and 'None' disables session persistence.
$19
Get all 558 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
