HOTSPOT -
You plan to migrate App1 to Azure.
You need to recommend a storage solution for App1 that meets the security and compliance requirements.
Which type of storage should you recommend, and how should you recommend configuring the storage? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: Standard general-purpose v2
Hierarchical namespace
Explanation: Standard general-purpose v2 supports Azure Blob Storage with immutability policies, private endpoints, and compliance features. Enabling a hierarchical namespace provides Azure Data Lake Storage Gen2 capabilities, including POSIX-like ACLs and secure access control, while remaining compatible with immutability and network isolation requirements.
Question 136
You plan to automata the deployment of resources to Azure subscriptions.
What is a difference between using Azure Blueprints and Azure Resource Manager (ARM) templates?
A. ARM templates remain connected to the deployed resources.
B. Only blueprints can contain policy definitions.
C. Only ARM templates can contain policy definitions.
D. Blueprints remain connected to the deployed resources.
Show Answer
Correct Answer: D
Explanation: Azure Blueprints preserve an ongoing relationship between the blueprint definition and the deployed resources, enabling tracking, auditing, and governance over time. ARM templates are used for deployment only and do not remain connected to the resources after deployment.
Question 137
You have an application that is used by 6,000 users to validate their vacation requests. The application manages its own credential store.
Users must enter a username and password to access the application. The application does NOT support identity providers.
You plan to upgrade the application to use single sign-on (SSO) authentication by using an Azure Active Directory (Azure AD) application registration.
Which SSO method should you use?
A. header-based
B. SAML
C. password-based
D. OpenID Connect
Show Answer
Correct Answer: C
Explanation: The application does not support identity providers and manages its own credential store. Protocol-based SSO methods like SAML or OpenID Connect require the application to trust and integrate with an identity provider, which the app cannot do. Azure AD password-based SSO is specifically designed for applications that cannot be modified to support modern authentication; Azure AD securely stores the credentials and signs users in automatically, enabling SSO without changing the app.
Question 138
DRAG DROP -
You need to configure an Azure policy to ensure that the Azure SQL databases have Transparent Data Encryption (TDE) enabled. The solution must meet the security and compliance requirements.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Select and Place:
Show Answer
Correct Answer: Create an Azure policy definition that uses the deployIfNotExists effect.
Create an Azure policy assignment.
Invoke a remediation task.
Explanation: To enforce TDE on Azure SQL Databases, a deployIfNotExists policy is required to automatically enable TDE when it is missing. After defining the policy, it must be assigned to a scope so Azure Policy can evaluate resources. Finally, a remediation task is invoked to bring existing non-compliant databases into compliance by enabling TDE.
Question 139
HOTSPOT -
You are evaluating whether to use Azure Traffic Manager and Azure Application Gateway to meet the connection requirements for App1.
What is the minimum numbers of instances required for each service? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
Explanation: Azure Traffic Manager is a global, DNS-based service, so a single instance can direct users to different regions. Azure Application Gateway is a regional service; to serve East US and West Europe with high availability, one gateway is required per region, totaling two.
Question 140
HOTSPOT -
You plan to migrate App1 to Azure.
You need to recommend a high-availability solution for App1. The solution must meet the resiliency requirements.
What should you include in the recommendation? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: Number of host groups: 3
Number of virtual machine scale sets: 3
Explanation: To remain available after the failure of two availability zones, App1 must be deployed across all three zones in the region. An Azure dedicated host group is scoped to a single availability zone, so one host group is required per zone. A VM scale set that uses dedicated hosts must be in the same availability zone as its host group, therefore one VM scale set is also required per zone.
Question 141
HOTSPOT -
To meet the authentication requirements of Fabrikam, what should you include in the solution? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: Minimum number of Azure AD tenants: 1
Minimum number of custom domains to add: 1
Minimum number of conditional access policies to create: 2
Explanation: A single Azure AD tenant satisfies the migration scope. One custom domain is required to replace the default *.onmicrosoft.com domain. Two Conditional Access policies are needed: one to enforce MFA for administrative access and a separate one to restrict access based on location (blocking access from outside company locations).
Question 143
You have an Azure subscription.
You need to recommend a solution to provide developers with the ability to provision Azure virtual machines. The solution must meet the following requirements:
✑ Only allow the creation of the virtual machines in specific regions.
✑ Only allow the creation of specific sizes of virtual machines.
What should you include in the recommendation?
A. Attribute-based access control (ABAC)
B. Azure Policy
C. Conditional Access policies
D. role-based access control (RBAC)
Show Answer
Correct Answer: B
Explanation: Azure Policy is designed to enforce rules on Azure resources. It can restrict where resources are deployed (allowed locations) and which VM SKUs/sizes are permitted. RBAC and ABAC control who can act, not what configurations are allowed, and Conditional Access applies to user sign-in, not resource properties.
Question 144
You have an on-premises line-of-business (LOB) application that uses a Microsoft SQL Server instance as the backend.
You plan to migrate the on-premises SQL Server instance to Azure virtual machines.
You need to recommend a highly available SQL Server deployment that meets the following requirements:
✑ Minimizes costs
Minimizes failover time if a single server fails
What should you include in the recommendation?
A. an Always On availability group that has premium storage disks and a virtual network name (VNN)
B. an Always On Failover Cluster Instance that has a virtual network name (VNN) and a standard file share
C. an Always On availability group that has premium storage disks and a distributed network name (DNN)
D. an Always On Failover Cluster Instance that has a virtual network name (VNN) and a premium file share
Show Answer
Correct Answer: C
Explanation: The requirements are to minimize costs and minimize failover time for a single server failure. An Always On Availability Group (AG) generally has lower overall cost in Azure than a Failover Cluster Instance (FCI) because it does not require shared storage (Azure shared disks or file shares). Using a Distributed Network Name (DNN) listener avoids the need for an Azure Load Balancer, further reducing cost and complexity. AG failover is typically faster than FCI failover because it is database-level and does not require full instance recovery. Premium disks are the recommended and supported option for SQL Server data files in Azure VMs to ensure predictable performance and fast recovery. Therefore, an Always On availability group with premium storage disks and a DNN best meets both cost and failover-time requirements.
Question 146
You need to recommend a solution to generate a monthly report of all the new Azure Resource Manager (ARM) resource deployments in your Azure subscription.
What should you include in the recommendation?
A. Azure Activity Log
B. Azure Arc
C. Azure Analysis Services
D. Azure Monitor action groups
Show Answer
Correct Answer: A
Explanation: To generate a monthly report of new Azure Resource Manager (ARM) resource deployments, you need a service that records subscription-level deployment and write operations. The Azure Activity Log captures all control-plane operations such as resource deployments (PUT operations), including who performed them and when. These logs can be filtered for deployment events and exported to Log Analytics, Storage, or Event Hubs to produce scheduled monthly reports. The other options do not track ARM deployment activity.
$19
Get all 273 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
