HOTSPOT
-
You have a Microsoft Entra tenant that contains the users shown in the following table.
The tenant contains the groups shown in the following table.
Which users and groups can be deleted? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Users: User1, User2, User3, and User4
Groups: Group1 and Group3 only
Explanation: Users can be deleted even if they have directly assigned licenses; the licenses are removed with the user. Groups with licenses assigned directly (Group2 and Group4) cannot be deleted until the license assignment is removed. Nested groups are not used for group-based licensing, so Group3 can be deleted despite being a member of Group4.
Question 15
You have an Azure subscription that contains the virtual networks shown in the following table.
You need to ensure that all the traffic between VNet1 and VNet2 traverses the Microsoft backbone network.
What should you configure?
A. a private endpoint
B. peering
C. Express Route
D. a route table
Show Answer
Correct Answer: B
Explanation: Configure global virtual network peering between VNet1 and VNet2. Peering connects the VNets directly, and traffic between them travels over the Microsoft backbone network.
Question 16
Your on-premises network contains a VPN gateway.
You have an Azure subscription that contains the resources shown in the following table.
You need to ensure that all the traffic from VM1 to storage1 travels across the Microsoft backbone network.
What should you configure?
A. Azure Application Gateway
B. service endpoints
C. a network security group (NSG)
D. Azure Peering Service
Show Answer
Correct Answer: B
Explanation: Configure a Microsoft.Storage service endpoint on VM1’s subnet. It routes traffic from the subnet to the storage service over the Microsoft backbone, rather than through the on-premises VPN gateway despite forced tunneling being enabled.
Question 16
HOTSPOT
-
You have an Azure subscription that contains a storage account named storage1.
You need to configure a shared access signature (SAS) to ensure that users can only download blobs securely by name.
Which two settings should you configure? To answer, select the appropriate settings in the answer area.
NOTE: Each correct answer is worth one point.
Explanation: Object allows access to blobs by name, and Read permits downloading without granting write, delete, or list access.
Question 17
HOTSPOT
-
You have an Azure subscription that has the Azure container registries shown in the following table.
You plan to use ACR Tasks and configure private endpoint connections.
Which container registries support ACR Tasks and private endpoints? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: ACR Tasks: ContReg1, ContReg2, and ContReg3
Private endpoints: ContReg1 only
Explanation: ACR Tasks are supported on Basic, Standard, and Premium SKUs (with differing limits). Private endpoint connections are supported only on the Premium SKU.
Question 17
You have an Azure subscription that contains the resources shown in the following table.
You need to configure a proximity placement group for VMSS1.
Which proximity placement groups should you use?
A. Proximity2 only
B. Proximity1, Proximity2, and Proximity3
C. Proximity1 only
D. Proximity1 and Proximity3 only
Show Answer
Correct Answer: C
Explanation: Use Proximity1 only. VMSS1 is located in West US, so its proximity placement group must also be in West US. Proximity2 and Proximity3 are in Central US; resource group membership does not determine compatibility.
Question 17
You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers.
You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines.
You need to ensure that visitors are serviced by the same web server for each request.
What should you configure?
A. Session persistence to Client IP and protocol
B. Idle Time-out (minutes) to 20
C. Session persistence to None
D. Floating IP (direct server return) to Enabled
Show Answer
Correct Answer: A
Explanation: Configure session persistence to **Client IP and protocol**. Azure Load Balancer then directs requests from the same client using the same protocol to the same backend web server.
Question 18
You have an Azure subscription that contains a storage account named storage. The storage account contains a blob that stores images.
Client access to storage1 is granted by using a shared access signature (SAS).
You need to ensure that users receive a warning message when they generate a SAS that exceeds a seven-day time period.
What should you do for storage?
A. Enable a read-only lock.
B. Configure an alert rule.
C. Add a lifecycle management rule.
D. Set Allow recommended upper limit for shared access signature (SAS) expiry interval to Enabled.
Show Answer
Correct Answer: D
Explanation: Enabling the recommended upper limit for SAS expiry interval and configuring it to seven days causes users to receive a warning when they generate a SAS that exceeds the recommended validity period. A read-only lock, alert rule, and lifecycle management rule do not provide this SAS generation warning behavior.
Question 18
You have an Azure subscription.
You create the following Azure Resource Manager (ARM) template named Template.json.
You need to deploy Template.json.
Which PowerShell cmdlet should you run from Azure Cloud Shell?
A. New-AzSubscriptionDeployment
B. New-AzManagementGroupDeployment
C. New-AzResourceGroupDeployment
D. New-AzTenantDeployment
Show Answer
Correct Answer: A
Explanation: The template creates a resource of type `Microsoft.Resources/resourceGroups`. Creating a resource group is a subscription-scope operation, so deploy it with `New-AzSubscriptionDeployment`.
Question 18
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure Active Directory (Azure AD) tenant named contoso.com.
You have a CSV file that contains the names and email addresses of 500 external users.
You need to create a guest user account in contoso.com for each of the 500 external users.
Solution: You create a PowerShell script that runs the New-MgInvitation cmdlet for each external user.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: A
Explanation: Yes. A script can loop through the CSV and call New-MgInvitation for each user, supplying a redirect URL in the command. Creating the invitation creates the guest user account in the tenant; the user can redeem the invitation later.
$19
Get all 558 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
