You have an Azure subscription that contains the resources shown in the following table.
You create a route table named RT1 in the East US Azure region.
To which resources can you associate RT1?
A. VNet1 only
B. Subnet1 only
C. VNet1 and NIC1 only
D. Subnet1 and NIC1 only
E. VNet1, Subnet1, and NIC1
Show Answer
Correct Answer: B
Explanation: In Azure, user-defined route tables can only be associated with subnets. They cannot be associated directly with a virtual network (VNet) or a network interface (NIC). All NICs and resources within a subnet inherit the routes from the route table linked to that subnet, provided the subnet is in the same region and subscription as the route table.
Question 49
You have two Azure subscriptions named Sub1 and Sub2 that are linked to separate Microsoft Entra tenants.
You have the virtual networks shown in the following table.
Which virtual networks can you peer with VNet1?
A. VNet2 only
B. VNet2 and VNet3 only
C. VNet2 and VNet4 only
D. VNet2, VNet3, and VNet4 only
E. VNet2, VNet3, VNet4, and VNet5
Show Answer
Correct Answer: E
Explanation: Azure virtual network peering supports peering across different subscriptions, different Azure regions (global VNet peering), and different Microsoft Entra tenants (cross-tenant peering), provided permissions are configured and address spaces do not overlap. Since no overlapping IP ranges are specified, VNet1 can be peered with VNet2, VNet3, VNet4, and VNet5.
Question 51
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure Storage account named storage1.
You need to enable a user named User1 to list and regenerate storage account keys for storage1.
Solution: You assign the Storage Account Encryption Scope Contributor Role to User1.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: The Storage Account Encryption Scope Contributor role only allows management of encryption scopes within a storage account. It does not include permissions to list or regenerate storage account access keys. To list and regenerate keys, roles such as Storage Account Key Operator Service Role, Storage Account Contributor, Contributor, or Owner are required. Therefore, the proposed solution does not meet the goal.
Question 52
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure Storage account named storage1.
You need to enable a user named User1 to list and regenerate storage account keys for storage1.
Solution: You assign the Reader and Data Access role to User1.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: The Reader and Data Access role only allows read access to storage account data and metadata. It does not grant permissions to list or regenerate storage account access keys. To list and regenerate keys, a role such as Storage Account Key Operator Service Role (or Owner/Contributor) is required. Therefore, the proposed solution does not meet the goal.
Question 53
HOTSPOT
-
Your network contains an on-premises Active Directory Domain Services (AD DS) domain.
The domain contains the identities shown in the following table.
You have an Azure subscription that contains a storage account named storage1. The file shares in storage1 have an identity source of AD DS and Default share-level permissions set to Enable permissions for all authenticated users and groups.
You create an Azure Files share named share1 that has the roles shown in the following table.
You have a Microsoft Entra tenant that contains a cloud-only user named User3.
You use Microsoft Entra Connect to sync OU1 from the AD DS domain to the Microsoft Entra tenant.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: User1: Yes
User2: Yes
User3: No
Explanation: Azure Files share uses AD DS authentication. Share-level RBAC is evaluated using synced identities. Group1 is synced from OU1 and has SMB Share Contributor on share1, so its on-prem AD members (including User1) can access the share via AD DS. User2 is synced and directly assigned SMB Share Reader, so access is allowed. User3 is cloud-only and not represented in AD DS, so cannot access an AD DS–backed Azure Files share.
Question 54
You have an Azure subscription that contains the resources shown in the following table.
You need to ensure that data transfers between storage1 and VM1 do NOT traverse the internet
What should you configure for storage1?
A. data protection
B. a private endpoint
C. Public network access in the Firewalls and virtual networks settings
D. a shared access signature (SAS)
Show Answer
Correct Answer: B
Explanation: To ensure traffic between VM1 and storage1 does not traverse the public internet, you must use a private endpoint. A private endpoint assigns a private IP address from the virtual network to the storage account, allowing VM1 to access storage1 entirely over the Azure virtual network and Microsoft backbone. Other options do not prevent internet-based access.
Question 55
You have an Azure subscription named Subscription1 that contains the resources shown in the following table.
You create virtual machines in Subscription1 as shown in the following table.
You plan to use Vault1 for the backup of as many virtual machines as possible.
Which virtual machines can be backed up to Vault1?
A. VM1 only
B. VM3 and VMC only
C. VM1, VM2, VM3, VMA, VMB, and VMC
D. VM1, VM3, VMA, and VMC only
E. VM1 and VM3 only
Show Answer
Correct Answer: D
Explanation: An Azure VM can be backed up only to a Recovery Services Vault located in the same Azure region as the VM. Resource group and OS type do not restrict backup eligibility. Vault1 is in West Europe, so only the VMs that are also deployed in West Europe can be backed up to Vault1, which are VM1, VM3, VMA, and VMC.
Question 56
You have an Azure subscription that contains an Azure container registry named ContReg1.
You enable the Admin user for ContReg1.
Which username can you use to sign in to ContReg1?
A. root
B. admin
C. administrator
D. ContReg1
Show Answer
Correct Answer: D
Explanation: When the Admin user is enabled for an Azure Container Registry, the username used to sign in is the registry name itself. Therefore, for a registry named ContReg1, the username is ContReg1, with one of the admin access keys used as the password.
Question 59
HOTSPOT -
You have a Microsoft Entra tenant that contains the groups shown in the following table.
The tenant contains the users shown in the following table.
Which users and groups can you delete? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Users:
User1, User2, User3, and User4
Groups:
Group2 and Group4 only
Explanation: In Microsoft Entra ID, users can always be deleted even if they have licenses assigned directly or inherited from a group; deleting the user simply frees the license. Groups, however, cannot be deleted if they have active license assignments. Therefore, only groups without assigned licenses (Group2: Security, no license; Group4: Microsoft 365, no license) can be deleted.
Question 60
HOTSPOT -
You have an Azure Storage account named contoso2024 that contains the resources shown in the following table.
You have users that have permissions for contoso2024 as shown in the following table.
The contoso2024 account is configured as shown in the following exhibit.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: User1 can read File1: No
User2 can read File2: No
User3 can read File1 and File2: No
Explanation: Reading blob or file data requires data-plane roles (e.g., Storage Blob Data Reader / Storage File Data Reader) or shared key/SAS. User1 (Reader) and User2 (Storage Account Contributor) have only management-plane permissions and no data actions. Public blob access is merely allowed at the account level but not configured on the container. Storage account key access is disabled, so User3 cannot use the access key to read any data.
$19
Get all 558 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
