You have an Azure subscription that contains the resources shown in the following table.
You need to configure a proximity placement group for VMSS1.
Which proximity placement groups should you use?
A. Proximity2 only
B. Proximity1, Proximity2, and Proximity3
C. Proximity1 only
D. Proximity1 and Proximity3 only
Show Answer
Correct Answer: C
Explanation: A proximity placement group must be created in the same Azure region as the compute resource it will be associated with. VMSS1 can only use a proximity placement group in its own region. Based on the scenario, only Proximity1 is in the same location (West US) as VMSS1, so Proximity2 and Proximity3 cannot be used.
Question 62
You have an Azure subscription.
You create the following Azure Resource Manager (ARM) template named Template.json.
You need to deploy Template.json.
Which PowerShell cmdlet should you run from Azure Cloud Shell?
A. New-AzSubscriptionDeployment
B. New-AzManagementGroupDeployment
C. New-AzResourceGroupDeployment
D. New-AzTenantDeployment
Show Answer
Correct Answer: A
Explanation: The correct cmdlet depends on the deployment scope. If the ARM template is deployed at the subscription scope (for example, because it creates a resource group or other subscription-level resources), you use New-AzSubscriptionDeployment. Resource-group-scope deployments use New-AzResourceGroupDeployment, while management group and tenant deployments use their respective cmdlets.
Question 63
You have an Azure subscription that contains a resource group named RG1.
You plan to create a storage account named storage1.
You have a Bicep file named File1.
You need to modify File1 so that it can be used to automate the deployment of storage1 to RG1.
Which property should you modify?
A. kind
B. scope
C. sku
D. location
Show Answer
Correct Answer: B
Explanation: The correct property is `scope`. In Bicep, `scope` is used to target the deployment to a specific resource group, subscription, management group, or tenant. If the goal is to deploy the storage account to resource group RG1 (rather than the default deployment scope), the Bicep file must be modified to use the appropriate scope. The `kind`, `sku`, and `location` properties define characteristics of the storage account itself, not the deployment target.
Question 64
You have an Azure subscription.
You plan to migrate 50 virtual machines from VMware vSphere to the subscription.
You create a Recovery Services vault.
What should you do next?
A. Configure an extended network.
B. Create a recovery plan.
C. Deploy an Open Virtualization Application (OVA) template to vSphere.
D. Configure a virtual network.
Show Answer
Correct Answer: D
Explanation: Given the Recovery Services vault has already been created and the scenario aligns with Azure Site Recovery preparation, the next Azure-side prerequisite is configuring the target virtual network. Recovery plans are created later, extended networking is optional, and deploying the OVA/configuration server occurs after Azure prerequisites are prepared.
Question 65
HOTSPOT
-
Your company purchases a new Azure subscription.
You create a file named Deploy.json as shown in the following exhibit.
You connect to the subscription and run the following cmdlet.
New-AzDeployment -Location westus -TemplateFile “deploy.json”
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Yes
No
Yes
Explanation: The template creates resource groups RG0, RG1, and RG2 (copyIndex starts at 0). RG1 receives a CanNotDelete lock, which still allows creating resources. RG2 receives a ReadOnly lock, which blocks creating a VM. RG3 is not created, so it can be created manually if the name is available.
Question 66
HOTSPOT
-
You have an Azure Storage account named storage1 that contains a container named container1. The container1 container stores thousands of image files.
You plan to use an Azure Resource Manager (ARM) template to create a blob inventory rule named rule1.
You need to ensure that only blobs whose names start with the word finance are stored daily as a CSV file in container1.
How should you complete rule1? To answer, select the options in the answer area.
NOTE: Each correct answer is worth one point.
Explanation: Inventory filters apply to blob types and blob name prefixes. The images are standard block blobs, and prefixMatch uses the container name followed by the blob name prefix (container1/finance) to match blobs whose names start with 'finance' in container1. CSV is the inventory output format and schedule is already daily.
Question 67
HOTSPOT
-
You have an Azure Storage account named storage1 that contains two containers named container1 and container2. Blob versioning is enabled for both containers.
You periodically take blob snapshots of critical blobs.
You create the following lifecycle management policy.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: No
No
No
Explanation: The policy defines actions only for blob versions (not snapshots), filters only blobs under container1 via prefixMatch, and archiving also requires both creation age >30 days and last tier change >7 days, so a rehydrated version is not guaranteed to archive exactly after 30 days.
Question 68
Your on-premises network contains a VPN gateway.
You have an Azure subscription that contains the resources shown in the following table.
You need to ensure that all the traffic from VM1 to storage1 travels across the Microsoft backbone network.
What should you configure?
A. Azure AD Application Proxy
B. service endpoints
C. a network security group (NSG)
D. Azure Firewall
Show Answer
Correct Answer: B
Explanation: Service endpoints enable traffic from a subnet in an Azure virtual network to Azure PaaS services such as Azure Storage over the Microsoft backbone network. This ensures VM1 reaches storage1 using Azure's backbone rather than the public Internet. Azure AD Application Proxy is unrelated, and NSGs and Azure Firewall filter traffic but do not change the path onto the Microsoft backbone.
Question 69
Your on-premises network contains a VPN gateway.
You have an Azure subscription that contains the resources shown in the following table.
You need to ensure that all the traffic from VM1 to storage1 travels across the Microsoft backbone network.
What should you configure?
A. Azure AD Application Proxy
B. private endpoints
C. a network security group (NSG)
D. Azure Peering Service
Show Answer
Correct Answer: B
Explanation: Private endpoints (Azure Private Link) assign a private IP address in the virtual network to the storage account, ensuring traffic from the VM to the storage resource stays on the Microsoft backbone network and can be accessed privately. Azure AD Application Proxy is unrelated, an NSG only filters traffic, and Azure Peering Service is for optimizing connectivity between enterprise networks and Microsoft services, not private VM-to-storage access within Azure.
Question 70
HOTSPOT -
You have an Azure subscription that contains a storage account named storage1. The storage1 account contains blobs in a container named container1.
You plan to share access to storage1.
You need to generate a shared access signature (SAS). The solution must meet the following requirements:
• Ensure that the SAS can only be used to enumerate and download blobs stored in container1.
• Use the principle of least privilege.
Which three settings should you enable? To answer, select the appropriate settings in the answer area.
Explanation: Blob limits the SAS to blob service. Container scope allows listing blobs within the specific container. Read permits downloading blobs, and List permits enumerating blobs. This satisfies least privilege for the stated requirements.
$19
Get all 555 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
