Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your company plans to deploy various Azure App Service instances that will use Azure SQL databases. The App Service instances will be deployed at the same time as the Azure SQL databases.
The company has a regulatory requirement to deploy the App Service instances only to specific Azure regions. The resources for the App Service instances must reside in the same region.
You need to recommend a solution to meet the regulatory requirement.
Solution: You recommend using an Azure Policy initiative to enforce the location.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: A
Explanation: Yes. Azure Policy includes built-in policies such as 'Allowed locations' and can be grouped into an initiative to enforce deployment only to specified Azure regions. This satisfies the requirement to restrict App Service deployments to specific regions, and ensuring related resources are deployed in the same region can also be governed through appropriate policy assignments.
Question 130
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your company plans to deploy various Azure App Service instances that will use Azure SQL databases. The App Service instances will be deployed at the same time as the Azure SQL databases.
The company has a regulatory requirement to deploy the App Service instances only to specific Azure regions. The resources for the App Service instances must reside in the same region.
You need to recommend a solution to meet the regulatory requirement.
Solution: You recommend creating resource groups based on locations and implementing resource locks on the resource groups.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: Resource groups and resource locks do not enforce deployment to specific Azure regions. Resource locks only prevent deletion or modification of resources. To restrict where resources can be created, Azure Policy with an allowed locations policy should be used. Therefore, the proposed solution does not meet the regulatory requirement.
Question 131
You need to recommend a solution that meets the data requirements for App1.
What should you recommend deploying to each availability zone that contains an instance of App1?
A. an Azure Cosmos DB that uses multi-region writes
B. an Azure Data Lake store that uses geo-zone-redundant storage (GZRS)
C. an Azure Storage account that uses geo-zone-redundant storage (GZRS)
Show Answer
Correct Answer: A
Explanation: Azure Cosmos DB with multi-region writes is the only option that supports active-active write capability while making data written by any application instance visible to all other instances with low latency. GZRS storage and Data Lake replication are for durability and disaster recovery, not active multi-writer, cross-zone application data synchronization.
Question 132
DRAG DROP -
You need to recommend a solution that meets the file storage requirements for App2.
What should you deploy to the Azure subscription and the on-premises network? To answer, drag the appropriate services to the correct locations. Each service may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Select and Place:
Explanation: Azure Files provides the cloud file share, while Azure File Sync extends it to on-premises Windows servers, enabling local SMB access with synchronization to Azure.
Question 133
You need to recommend a notification solution for the IT Support distribution group.
What should you include in the recommendation?
A. a SendGrid account with advanced reporting
B. an action group
C. Azure Network Watcher
D. Azure AD Connect Health
Show Answer
Correct Answer: D
Explanation: Azure AD Connect Health (now Microsoft Entra Connect Health) is the service specifically designed to monitor hybrid identity synchronization and can send email notifications to a distribution group when health alerts are generated or resolved. An action group is a generic Azure Monitor notification mechanism, but for notifications about Azure AD Connect health, the dedicated health service is the appropriate recommendation.
Question 134
You plan to migrate App1 to Azure.
You need to recommend a network connectivity solution for the Azure Storage account that will host the App1 data. The solution must meet the security and compliance requirements.
What should you include in the recommendation?
A. Microsoft peering for an ExpressRoute circuit
B. Azure public peering for an ExpressRoute circuit
C. a service endpoint that has a service endpoint policy
D. a private endpoint
Show Answer
Correct Answer: D
Explanation: The recommended solution is a private endpoint. Azure Private Endpoint provides private IP connectivity to the Azure Storage account over Azure Private Link, keeping traffic off the public internet and meeting stricter security and compliance requirements. Microsoft peering is used to reach Microsoft services over ExpressRoute but does not by itself provide private endpoint access to the storage account. Azure public peering has been deprecated, and service endpoints secure access from Azure VNets but do not provide the same private connectivity or isolation as Private Link.
Question 135
HOTSPOT -
You plan to migrate App1 to Azure.
You need to recommend a storage solution for App1 that meets the security and compliance requirements.
Which type of storage should you recommend, and how should you recommend configuring the storage? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: Standard general-purpose v2
Hierarchical namespace
Explanation: Azure Data Lake Storage Gen2 is built on a standard GPv2 storage account with hierarchical namespace enabled, providing POSIX-style ACLs and meeting common security/compliance requirements. NFSv3 does not provide the required ACL-based authorization in this scenario.
Question 136
You plan to automata the deployment of resources to Azure subscriptions.
What is a difference between using Azure Blueprints and Azure Resource Manager (ARM) templates?
A. ARM templates remain connected to the deployed resources.
B. Only blueprints can contain policy definitions.
C. Only ARM templates can contain policy definitions.
D. Blueprints remain connected to the deployed resources.
Show Answer
Correct Answer: D
Explanation: Azure Blueprints preserve the relationship between the blueprint definition and deployed resources, enabling ongoing tracking, auditing, and governance. ARM templates are used for deployment but do not maintain an active connection to deployed resources after deployment. Both Azure Blueprints and ARM templates can include Azure Policy definitions, so options B and C are incorrect.
Question 137
You have an application that is used by 6,000 users to validate their vacation requests. The application manages its own credential store.
Users must enter a username and password to access the application. The application does NOT support identity providers.
You plan to upgrade the application to use single sign-on (SSO) authentication by using an Azure Active Directory (Azure AD) application registration.
Which SSO method should you use?
A. header-based
B. SAML
C. password-based
D. OpenID Connect
Show Answer
Correct Answer: C
Explanation: Because the application manages its own username/password store and explicitly does not support identity providers, federation protocols such as OpenID Connect or SAML cannot be used without changing the application's authentication model. Azure AD password-based SSO is designed for applications that authenticate with their own credential store by securely storing and replaying user credentials to provide SSO.
Question 138
DRAG DROP -
You need to configure an Azure policy to ensure that the Azure SQL databases have Transparent Data Encryption (TDE) enabled. The solution must meet the security and compliance requirements.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Select and Place:
Show Answer
Correct Answer: Create an Azure policy definition that uses the deployIfNotExists effect.
Create an Azure policy assignment.
Invoke a remediation task.
Explanation: To automatically ensure TDE is enabled, use a deployIfNotExists policy, assign it to the target scope, then run a remediation task so existing noncompliant databases are updated. The Modify effect is not appropriate for deploying TDE, and a managed identity is typically created as part of policy assignment when needed.
$19
Get all 271 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
