You have a Microsoft 365 tenant and an Azure Active Directory (Azure AD) tenant named contoso.com.
You plan to grant three users named User1, User2, and User3 access to a temporary Microsoft SharePoint document library named Library1.
You need to create groups for the users. The solution must ensure that the groups are deleted automatically after 180 days.
Which two groups should you create? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
A. a Microsoft 365 group that uses the Assigned membership type
B. a Security group that uses the Assigned membership type
C. a Microsoft 365 group that uses the Dynamic User membership type
D. a Security group that uses the Dynamic User membership type
E. a Security group that uses the Dynamic Device membership type
Show Answer
Correct Answer: A, C
Explanation: The requirement is automatic deletion after 180 days, which is provided by Azure AD/Microsoft Entra group expiration policies. Expiration policies are supported only for Microsoft 365 groups, not for security groups. Both assigned-membership and dynamic user–membership Microsoft 365 groups can have an expiration policy applied, and Microsoft 365 groups are appropriate for SharePoint access. Therefore, the correct choices are A and C.
Question 277
HOTSPOT -
You have an Azure subscription named Subscription1 that contains a resource group named RG1.
In RG1, you create an internal load balancer named LB1 and a public load balancer named LB2.
You need to ensure that an administrator named Admin1 can manage LB1 and LB2. The solution must follow the principle of least privilege.
Which role should you assign to Admin1 for each task? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: To add a backend pool to LB1:
Network Contributor on LB1
To add a health probe to LB2:
Network Contributor on LB2
Explanation: The Network Contributor role includes permissions to configure load balancer components such as backend pools and health probes. Assigning the role directly at the load balancer resource scope (LB1 and LB2) provides the required management capabilities while adhering to the principle of least privilege, avoiding unnecessary access to other resources in RG1.
Question 278
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure subscription that contains the following users in an Azure Active Directory tenant named contoso.onmicrosoft.com:
User1 creates a new Azure Active Directory tenant named external.contoso.onmicrosoft.com.
You need to create new user accounts in external.contoso.onmicrosoft.com.
Solution: You instruct User4 to create the user accounts.
Does that meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: When a new Azure AD (Microsoft Entra ID) tenant is created, only the creator is automatically assigned the Global Administrator role in that tenant. Other users from the original tenant (including User4) have no permissions in the new tenant unless they are explicitly invited and assigned appropriate directory roles. Therefore, instructing User4 to create user accounts in the new tenant does not meet the goal.
Question 279
You have an Azure subscription named Subscription1.
You have 5 TB of data that you need to transfer to Subscription1.
You plan to use an Azure Import/Export job.
What can you use as the destination of the imported data?
A. an Azure Cosmos DB database
B. Azure Blob storage
C. Azure Data Lake Store
D. the Azure File Sync Storage Sync Service
Show Answer
Correct Answer: B
Explanation: Azure Import/Export jobs support importing data into Azure Blob Storage (and Azure Files). Among the options given, Azure Blob storage is a valid destination. Azure Cosmos DB, Azure Data Lake Store, and Azure File Sync are not supported as Import/Export destinations.
Question 280
You have two Azure virtual machines named VM1 and VM2. You have two Recovery Services vaults named RSV1 and RSV2.
VM2 is backed up to RSV1.
You need to back up VM2 to RSV2.
What should you do first?
A. From the RSV1 blade, click Backup items and stop the VM2 backup
B. From the RSV2 blade, click Backup. From the Backup blade, select the backup for the virtual machine, and then click Backup
C. From the VM2 blade, click Disaster recovery, click Replication settings, and then select RSV2 as the Recovery Services vault
D. From the RSV1 blade, click Backup Jobs and export the VM2 job
Show Answer
Correct Answer: A
Explanation: An Azure VM can be protected by only one Recovery Services vault at a time. Before VM2 can be backed up to RSV2, it must be disassociated from RSV1. The first required step is to stop the existing backup in RSV1 (which also allows deletion of backup data). Only after stopping the backup can VM2 be discovered and protected by RSV2.
Question 281
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure subscription that contains the following users in an Azure Active Directory tenant named contoso.onmicrosoft.com:
User1 creates a new Azure Active Directory tenant named external.contoso.onmicrosoft.com.
You need to create new user accounts in external.contoso.onmicrosoft.com.
Solution: You instruct User3 to create the user accounts.
Does that meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: When User1 creates a new Azure AD tenant (external.contoso.onmicrosoft.com), only User1 is a Global Administrator in that new tenant by default. Administrative roles from the original tenant do not carry over. User3 has no permissions in the new tenant unless explicitly added and assigned a role there. Therefore, instructing User3 to create user accounts does not meet the goal.
Question 282
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure subscription that contains the following users in an Azure Active Directory tenant named contoso.onmicrosoft.com:
User1 creates a new Azure Active Directory tenant named external.contoso.onmicrosoft.com.
You need to create new user accounts in external.contoso.onmicrosoft.com.
Solution: You instruct User1 to create the user accounts.
Does that meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: A
Explanation: When a user creates a new Azure Active Directory tenant, that user becomes the first account in the tenant and is automatically assigned the Global Administrator role. As a Global Administrator of external.contoso.onmicrosoft.com, User1 has permission to create new user accounts in that tenant. Therefore, instructing User1 to create the user accounts meets the goal.
Question 283
Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.
Your company's Azure subscription includes two Azure networks named VirtualNetworkA and VirtualNetworkB.
VirtualNetworkA includes a VPN gateway that is configured to make use of static routing. Also, a site-to-site VPN connection exists between your company's on- premises network and VirtualNetworkA.
You have configured a point-to-site VPN connection to VirtualNetworkA from a workstation running Windows 10. After configuring virtual network peering between
VirtualNetworkA and VirtualNetworkB, you confirm that you are able to access VirtualNetworkB from the company's on-premises network. However, you find that you cannot establish a connection to VirtualNetworkB from the Windows 10 workstation.
You have to make sure that a connection to VirtualNetworkB can be established from the Windows 10 workstation.
Solution: You download and re-install the VPN client configuration package on the Windows 10 workstation.
Does the solution meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: Re-downloading and reinstalling the Point-to-Site VPN client does not by itself enable access to a peered VNet. To reach VirtualNetworkB from a P2S client connected to VirtualNetworkA, VNet peering must be configured with gateway transit (Allow gateway transit on VirtualNetworkA and Use remote gateway on VirtualNetworkB). Without these routing/peering settings, the client will not have a path to VirtualNetworkB regardless of reinstalling the VPN client.
Question 286
HOTSPOT -
You have two Azure App Service app named App1 and App2. Each app has a production deployment slot and a test deployment slot.
The Backup Configuration settings for the production slots are shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: No
No
Yes
Explanation: App1 retention is set to 0 (indefinite), so multiple backups accumulate; it will not have only one backup.
Backups are configured for production slots only; the App2 test slot has no backup to access.
An App Service backup from a production slot can be restored to another slot (such as the test slot) within the same app while within the retention period.
Question 287
You have an Azure subscription named Subscription1 that contains a virtual network named VNet1. VNet1 is in a resource group named RG1.
Subscription1 has a user named User1. User1 has the following roles:
✑ Reader
✑ Security Admin
✑ Security Reader
You need to ensure that User1 can assign the Reader role for VNet1 to other users.
What should you do?
A. Remove User1 from the Security Reader role for Subscription1. Assign User1 the Contributor role for RG1.
B. Assign User1 the Owner role for VNet1.
C. Assign User1 the Contributor role for VNet1.
D. Assign User1 the Network Contributor role for VNet1.
Show Answer
Correct Answer: B
Explanation: To assign Azure RBAC roles (such as Reader) to other users, a principal must have permission to manage access (Microsoft.Authorization/roleAssignments). Only the Owner or User Access Administrator roles include this permission. Contributor and Network Contributor can manage resources but cannot assign roles. Assigning User1 the Owner role scoped to VNet1 allows User1 to assign the Reader role for that VNet.
$19
Get all 558 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
