HOTSPOT
-
You have a Microsoft Entra tenant that contains the users shown in the following table.
The tenant contains the groups shown in the following table.
Which users and groups can be deleted? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Users:
User1, User2, User3, and User4
Groups:
Group1 and Group3 only
Explanation: Users can be deleted regardless of whether licenses are assigned directly or via group-based licensing.
Groups that have licenses assigned directly cannot be deleted. Group1 and Group3 have no licenses assigned to them, and nested group membership does not block deletion when the group itself has no license.
Question 16
HOTSPOT -
You have an Azure subscription.
You deploy a virtual machine scale set that is configured as shown in the following exhibit.
Use the drop-down menus to select the answer choice that answers each question based on the information presented in the graphic
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: 3
1
Explanation: Initial instances = 2.
Scale out: CPU >75% for 10 minutes adds 1 VM. From 9:00–9:15, only one scale-out action completes (at ~9:10), so total = 3.
Scale in: Starting with 5 VMs at 10:00, CPU <25% continuously. The scale-in rule removes 1 VM per evaluation cycle, down to the minimum of 1 VM. Over 60 minutes this reduces to the minimum, so total = 1.
Question 17
Case study -
This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided.
To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study.
At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new section, you cannot return to this section.
To start the case study -
To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the subsequent tabs. When you are ready to answer a question, click the Question button to return to the question.
Overview -
ADatum Corporation is consulting firm that has a main office in Montreal and branch offices in Seattle and New York.
Existing Environment -
Azure Environment -
ADatum has an Azure subscription that contains three resource groups named RG1, RG2, and RG3.
The subscription contains the storage accounts shown in the following table.
The subscription contains the virtual machines shown in the following table.
The subscription has an Azure container registry that contains the images shown in the following table.
The subscription contains the resources shown in the following table.
Azure Key Vault -
The subscription contains an Azure key vault named Vault1.
Vault1 contains the certificates shown in the following table.
Vault1 contains the keys shown in the following table.
Microsoft Entra Environment -
ADatum has a Microsoft Entra tenant named adatum.com that is linked to the Azure subscription and contains the users shown in the following table.
The tenant contains the groups shown in the following table.
The adatum.com tenant has a custom security attribute named Attribute1.
Planned Changes -
ADatum plans to implement the following changes:
• Configure a data collection rule (DCR) named DCR1 to collect only system events that have an event ID of 4648 from VM2 and VM4.
• In storage1, create a new container named cont2 that has the following access policies: o Three stored access policies named Stored1, Stored2, and Stored3 o A legal hold for immutable blob storage
• Whenever possible, use directories to organize storage account content.
• Grant User1 the permissions required to link Zone1 to VNet1.
• Assign Attribute1 to supported adatum.com resources.
• In storage2, create an encryption scope named Scope1.
• Deploy new containers by using Image1 or Image2.
Technical Requirements -
ADatum must meet the following technical requirements:
• Use TLS for WebApp1.
• Follow the principle of least privilege.
• Grant permissions at the required scope only.
• Ensure that Scope1 is used to encrypt storage services.
• Use Azure Backup to back up cont1 and share1 as frequently as possible.
• Whenever possible, use Azure Disk Encryption and a key encryption key (KEK) to encrypt the virtual machines.
You need to meet the technical requirements for the KEK.
Which PowerShell cmdlet and key should you use?
A. Set-AzVMDiskEncryptionExtension and Key2.
B. Set-AzDiskEncryptionKey and Key2.
C. Set-AzDiskDiskEncryptionKey and Key1.
D. Set-AzVMDiskEncryptionExtension and Key1.
Show Answer
Correct Answer: D
Explanation: To meet the requirement to use Azure Disk Encryption with a key encryption key (KEK) for virtual machines, you must use the cmdlet that enables disk encryption at the VM level. Set-AzVMDiskEncryptionExtension is the correct PowerShell cmdlet for encrypting OS and data disks of Azure VMs and supports specifying a KEK from Azure Key Vault. Azure Disk Encryption requires an RSA key for a KEK; elliptic curve keys are not supported. Therefore, the correct combination is Set-AzVMDiskEncryptionExtension with Key1 (the RSA key).
Question 17
HOTSPOT -
You have an Azure subscription that contains the virtual networks shown in the following table.
You have the virtual machines shown in the following table.
You have the virtual network interfaces shown in the following table.
Server1 is a DNS server that contains the resources shown in the following table.
You have an Azure private DNS zone named contoso.com that has a virtual network link to VNET2 and the records shown in the following table.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: No
Yes
No
Explanation: Server2 uses DNS 10.10.0.4 (Server1), which only has host1.contoso.com, not host2.
Server2 can resolve host1.contoso.com from Server1’s DNS zone.
Server3 inherits VNET2 DNS, which is set to 10.10.0.4, so it does not use the Azure Private DNS zone linked to VNET2 and cannot resolve host2.
Question 18
HOTSPOT
-
You have an Azure subscription that has the Azure container registries shown in the following table.
You plan to use ACR Tasks and configure private endpoint connections.
Which container registries support ACR Tasks and private endpoints? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: ACR Tasks:
ContReg1, ContReg2, and ContReg3
Private endpoints:
ContReg1 only
Explanation: ACR Tasks are supported on all Azure Container Registry SKUs (Basic, Standard, Premium), though with feature and quota limits. Private endpoint connections are supported only on the Premium tier.
Question 18
You have an Azure virtual machine named VM1.
The network interface for VM1 is configured as shown in the exhibit. (Click the Exhibit tab.)
You deploy a web server on VM1, and then create a secure website that is accessible by using the HTTPS protocol. VM1 is used as a web server only.
You need to ensure that users can connect to the website from the Internet.
What should you do?
A. Modify the protocol of Rule4
B. Delete Rule1
C. For Rule5, change the Action to Allow and change the priority to 401
D. Create a new inbound rule that allows TCP protocol 443 and configure the rule to have a priority of 501.
Show Answer
Correct Answer: C
Explanation: HTTPS uses TCP port 443. In the shown NSG configuration, an existing inbound rule with a higher priority denies HTTPS traffic before later rules are evaluated. Simply adding a new rule at priority 501 would not work because the deny rule with priority 500 would still take precedence. Changing Rule5 to Allow and adjusting its priority to 401 ensures it is processed before the deny rule, allowing inbound HTTPS traffic from the Internet to VM1.
Question 19
You have an Azure subscription that contains a storage account named storage. The storage account contains a blob that stores images.
Client access to storage1 is granted by using a shared access signature (SAS).
You need to ensure that users receive a warning message when they generate a SAS that exceeds a seven-day time period.
What should you do for storage?
A. Enable a read-only lock.
B. Configure an alert rule.
C. Add a lifecycle management rule.
D. Set Allow recommended upper limit for shared access signature (SAS) expiry interval to Enabled.
Show Answer
Correct Answer: D
Explanation: To warn users when they generate a SAS with an expiry longer than seven days, you must configure the built-in SAS expiration policy on the storage account. Enabling the recommended upper limit for SAS expiry interval allows Azure to display a warning during SAS generation when the expiry exceeds the configured threshold (such as seven days). Other options like locks, alerts, or lifecycle rules do not provide warnings at SAS creation time.
Question 19
HOTSPOT -
You have an Azure subscription that contains the resources in the following table.
You install the Web Server server role (IIS) on VM1 and VM2, and then add VM1 and VM2 to LB1.
LB1 is configured as shown in the LB1 exhibit. (Click the LB1 tab.)
Rule1 is configured as shown in the Rule1 exhibit. (Click the Rule1 tab.)
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: Box 1: Yes
Box 2: Yes
Box 3: No
Explanation: Box 1: A Basic SKU Load Balancer can only have backend VMs that are in the same availability set or the same VM scale set; since VM1 and VM2 are both in the backend pool, they must share one of these, so the statement is true.
Box 2: The load‑balancing rule uses an HTTP health probe on port 80; if Probe1.htm responds successfully on both VMs, LB1 will distribute TCP traffic on port 80 between them.
Box 3: Load balancing occurs only through configured load‑balancing rules; deleting Rule1 removes the mapping, so LB1 will not balance traffic on any port.
Question 20
You have a Microsoft Entra tenant named contoso.com.
You collaborate with an external partner named fabrikam.com.
You plan to invite users in fabrikam.com to the contoso.com tenant.
You need to ensure that invitations can be sent only to fabrikam.com users.
What should you do in the Microsoft Entra admin center?
A. From Cross-tenant access settings, configure the Tenant restrictions settings.
B. From Cross-tenant access settings, configure the Microsoft cloud settings.
C. From External collaboration settings, configure the Guest user access restrictions settings.
D. From External collaboration settings, configure the Collaboration restrictions settings.
Show Answer
Correct Answer: D
Explanation: To ensure invitations are sent only to users from fabrikam.com, you must restrict which external domains can be invited. In Microsoft Entra admin center, this is done under External Identities > External collaboration settings by configuring Collaboration restrictions to allow invitations only to specified domains (for example, fabrikam.com). Other options control access behavior or cross-tenant access, not invitation domain allowlisting.
Question 20
HOTSPOT -
You have an Azure subscription named Subscription1 that contains the virtual networks in the following table.
Subscription1 contains the virtual machines in the following table.
In Subscription1, you create a load balancer that has the following configurations:
✑ Name: LB1
✑ SKU: Basic
✑ Type: Internal
✑ Subnet: Subnet12
✑ Virtual network: VNET1
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: Yes
No
No
Explanation: LB1 is a **Basic internal load balancer**, which can only have backend VMs that are part of the **same availability set or VM scale set** within the same virtual network.
• **VM1 and VM2** are both in **Availability Set AS1**, so they can be load balanced.
• **VM3 and VM4** are not in any availability set or scale set, so they cannot be load balanced by a Basic SKU.
• **VM5 and VM6** are also not in an availability set or scale set, so they cannot be load balanced.
The subnet (Subnet12) only defines where the internal frontend IP is placed; backend VMs can be in different subnets within the same VNet, but Basic SKU restrictions still apply.
$19
Get all 558 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
