You have an Azure subscription that contains the resources shown in the following table.
You create a public IP address named IP1.
Which two resources can you associate to IP1? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
A. VM1
B. LB1
C. NIC1
D. VPN1
E. VNet1
Show Answer
Correct Answer: B, C
Explanation: A standalone Azure Public IP address resource can be associated directly with a load balancer frontend or a network interface (NIC). It is not associated directly with a virtual machine (the VM uses the NIC), nor with a virtual network. Although VPN gateways require a public IP resource, exam questions phrased around associating an existing Public IP to listed resources typically expect the gateway's public IP to be specified as part of gateway configuration rather than treated as a direct association target. Therefore, the correct choices are Load Balancer and NIC.
Question 42
HOTSPOT -
You have an Azure subscription that contains the resources shown in the following table.
You plan to use an Azure key vault to provide a secret to app1.
What should you create for app1 to access the key vault, and from which key vault can the secret be used? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Create a: Managed identity
Use the secret from: Vault1, Vault2, or Vault3
Explanation: Azure Container Apps use a managed identity to authenticate to Azure Key Vault. Key Vault access is not restricted by resource group or Azure region; with appropriate permissions and network configuration, the app can retrieve secrets from any of the listed vaults.
Question 43
HOTSPOT -
You have an Azure subscription that contains the virtual machines shown in the following table.
The subscription contains a storage account named contoso2024 as shown in the following exhibit.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
Show Answer
Correct Answer: Yes
Yes
No
Explanation: Subnet1 is allowed via a virtual network rule, so VM1 can access the storage account. Public IP firewall rules also allow explicitly listed public IPs, so VM2 can connect using its listed public IP despite being in Subnet2. VM3 is not required to use its private IP because no private endpoint is configured; 'must' is false.
Question 44
HOTSPOT
-
You have an Azure subscription that uses Azure Container Instances.
You have a computer that has Azure Command-Line Interface (CLI) and Docker installed.
You create a container image named image1.
You need to provision a new Azure container registry and add image1 to the registry.
Which command should you run for each requirement? To answer, select the options in the answer area.
NOTE: Each correct answer is worth one point.
Show Answer
Correct Answer: Provision a new container registry: az acr create
Add image1 to the registry: docker push
Explanation: Use 'az acr create' to create an Azure Container Registry. After tagging the local image for the registry, use 'docker push' to upload image1 to the registry.
Question 45
You have an Azure virtual network named VNet1 that contains the following settings:
• IPv4 address space: 172.16.10.0/24
• Subnet name: Subnet1
• Subnet address range: 172.16.10.0/25
What is the maximum number of virtual machines that can connect to Subnet1?
A. 24
B. 25
C. 123
D. 128
E. 251
Show Answer
Correct Answer: C
Explanation: A /25 subnet contains 128 IP addresses. In Azure, 5 IP addresses in each subnet are reserved, leaving 123 usable IP addresses for virtual machines and other resources. Therefore, the maximum number of VMs that can connect to the subnet is 123.
Question 46
DRAG DROP -
You have a Microsoft Entra tenant.
You need to ensure that when a new Microsoft 365 group is created, the group name is automatically formatted as follows:
Which three actions should you perform in sequence in the Microsoft Entra admin center? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Show Answer
Correct Answer: Create a group naming policy.
Set Add prefix to Attribute.
Set Select type to Department.
Explanation: A Microsoft Entra group naming policy supports using user attributes as prefixes/suffixes. To achieve <Department><Group name>, create the naming policy, configure the prefix as an attribute, then choose the Department attribute.
Question 47
You have an Azure subscription that contains the resources shown in the following table.
You create a route table named RT1 in the East US Azure region.
To which resources can you associate RT1?
A. VNet1 only
B. Subnet1 only
C. VNet1 and NIC1 only
D. Subnet1 and NIC1 only
E. VNet1, Subnet1, and NIC1
Show Answer
Correct Answer: B
Explanation: Azure route tables (user-defined routes) can only be associated with subnets, not directly with virtual networks or network interfaces. The route table and subnet must be in the same Azure region and subscription.
Question 48
You have two Azure subscriptions named Sub1 and Sub2 that are linked to separate Microsoft Entra tenants.
You have the virtual networks shown in the following table.
Which virtual networks can you peer with VNet1?
A. VNet2 only
B. VNet2 and VNet3 only
C. VNet2 and VNet4 only
D. VNet2, VNet3, and VNet4 only
E. VNet2, VNet3, VNet4, and VNet5
Show Answer
Correct Answer: E
Explanation: Azure virtual network peering supports peering across different subscriptions, Microsoft Entra tenants (with appropriate permissions), and different Azure regions (global VNet peering). The key technical restriction is that the virtual network address spaces must not overlap. Since the prompt does not indicate any overlapping address spaces, VNet1 can be peered with VNet2, VNet3, VNet4, and VNet5.
Question 49
HOTSPOT -
You have an Azure subscription that contains the virtual networks shown in the following table.
You have the peering options shown in the following exhibit.
You need to design a communication strategy for the resources on the virtual networks.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Peering 1-2: No
Peering 1-3: No
Peering 3-2: No
Explanation: VNet peering is supported within the same Azure cloud environment. Azure Public, Azure Government, and Azure China are separate cloud environments, so peering between them is not supported.
Question 50
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure Storage account named storage1.
You need to enable a user named User1 to list and regenerate storage account keys for storage1.
Solution: You assign the Storage Account Encryption Scope Contributor Role to User1.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: The Storage Account Encryption Scope Contributor role is limited to managing encryption scopes and does not include the permissions to list or regenerate storage account access keys (such as Microsoft.Storage/storageAccounts/listKeys/action and regenerateKey/action). To enable listing and regenerating storage account keys, assign the Storage Account Key Operator Service Role or a broader role such as Contributor or Storage Account Contributor.
$19
Get all 555 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
