HOTSPOT
-
You company has offices in New York City, Sydney, Paris, and Johannesburg.
The company has an Azure subscription.
You plan to deploy a new Azure networking solution that meets the following requirements:
• Connects to ExpressRoute circuits in the Azure regions of East US, Southeast Asia, North Europe, and South Africa
• Minimizes latency by supporting connection in three regions
• Supports Site-to-site VPN connections
• Minimizes costs
You need to identify the minimum number of Azure Virtual WAN hubs that you must deploy, and which virtual WAN SKU to use.
What should you identify? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Number of Virtual WAN hubs: 4
Virtual WAN SKU: Standard
Explanation: Deploy a hub for each of the four ExpressRoute regions to provide local connectivity and minimize latency. Standard supports both ExpressRoute and site-to-site VPN; Basic does not support ExpressRoute.
Question 8
HOTSPOT -
You are planning an Azure Storage solution for sensitive data. The data will be accessed daily. The dataset is less than 10 GB.
You need to recommend a storage solution that meets the following requirements:
• All the data written to storage must be retained for five years.
• Once the data is written, the data can only be read. Modifications and deletion must be prevented.
• After five years, the data can be deleted, but never modified.
• Data access charges must be minimized.
What should you recommend? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Storage account type: General purpose v2 with Hot access tier for blobs
Configuration to prevent modifications and deletions: Container access policy
Explanation: The Hot tier is suited to daily access and avoids the retrieval charges of the Cool tier. A container-level immutability policy can prevent changes and deletion during the five-year retention period.
Question 8
You need to design a highly available Azure SQL database that meets the following requirements:
• Failover between replicas of the database must occur without any data loss.
• The database must remain available in the event of a zone outage.
• Costs must be minimized.
Which deployment option should you use?
A. Azure SQL Managed Instance Business Critical
B. Azure SQL Database Business Critical
C. Azure SQL Database Basic
D. Azure SQL Database Standard
Show Answer
Correct Answer: B
Explanation: Azure SQL Database Business Critical provides synchronous replicas with zero-data-loss failover (RPO 0) and supports zone-redundant high availability to remain available during an Availability Zone outage. Among the listed options, it meets the requirements at lower cost than Azure SQL Managed Instance Business Critical. Basic and Standard tiers do not provide the required Business Critical high-availability architecture.
Question 8
Your company has the divisions shown in the following table.
Sub1 contains an Azure App Service web app named App1. App1 uses Azure AD for single-tenant user authentication. Users from contoso.com can authenticate to App1.
You need to recommend a solution to enable users in the fabrikam.com tenant to authenticate to App1.
What should you recommend?
A. Configure Azure AD join.
B. Configure Azure AD Identity Protection.
C. Configure a Conditional Access policy.
D. Configure Supported account types in the application registration and update the sign-in endpoint.
Show Answer
Correct Answer: D
Explanation: Configure the app registration to support accounts from multiple organizational directories, then update the sign-in endpoint to use a multi-tenant endpoint. This allows users in the fabrikam.com tenant to authenticate to App1. Azure AD join, Identity Protection, and Conditional Access do not change the app’s single-tenant sign-in configuration.
Question 9
Your company has the divisions shown in the following table.
Sub1 contains an Azure App Service web app named App1. App1 uses Azure AD for single-tenant user authentication. Users from contoso.com can authenticate to App1.
You need to recommend a solution to enable users in the fabrikam.com tenant to authenticate to App1.
What should you recommend?
A. Configure a Conditional Access policy.
B. Use Azure AD entitlement management to govern external users.
C. Configure the Azure AD provisioning service.
D. Configure Azure AD Identity Protection.
Show Answer
Correct Answer: B
Explanation: Use Azure AD entitlement management to create an access package that grants fabrikam.com users access to App1. They can authenticate with their home tenant and access the app as external B2B users represented in the contoso.com tenant. The other options do not provide this external-user access workflow.
Question 9
You plan to deploy an app that will use an Azure Storage account.
You need to deploy the storage account. The storage account must meet the following requirements:
✑ Store the data for multiple users.
✑ Encrypt each user's data by using a separate key.
✑ Encrypt all the data in the storage account by using customer-managed keys.
What should you deploy?
A. files in a premium file share storage account
B. blobs in a general purpose v2 storage account
C. blobs in an Azure Data Lake Storage Gen2 account
D. files in a general purpose v2 storage account
Show Answer
Correct Answer: B
Explanation: A general-purpose v2 account with Blob Storage supports customer-managed keys for account-level encryption and encryption scopes, which let you use separate keys for different users’ data. Use a separate scope for each user’s data.
Question 10
Your company has the divisions shown in the following table.
Sub1 contains an Azure App Service web app named App1. App1 uses Azure AD for single-tenant user authentication. Users from contoso.com can authenticate to App1.
You need to recommend a solution to enable users in the fabrikam.com tenant to authenticate to App1.
What should you recommend?
A. Configure Azure AD join.
B. Configure Azure AD Identity Protection.
C. Use Azure AD entitlement management to govern external users.
D. Configure assignments for the fabrikam.com users by using Azure AD Privileged Identity Management (PIM).
Show Answer
Correct Answer: C
Explanation: Use Azure AD entitlement management to create an access package for the App1 users and invite fabrikam.com users as external guests in the contoso.com tenant. The other options do not enable cross-tenant user access to the app.
Question 10
HOTSPOT
-
You have 100 Azure Storage accounts.
Access to the accounts is restricted by using Azure role-based access control (Azure RBAC) assignments.
You need to recommend a solution that uses role assignment conditions based on the tags assigned to individual resources within the storage accounts.
What should you include in the recommendation? To answer, select the appropriate options in the answer area.
Show Answer
Correct Answer: Attribute-based access control (ABAC)
Blobs
Explanation: Azure RBAC role assignment conditions that use resource tags are implemented with Azure ABAC. ABAC conditions for Azure Storage are supported for Blob Storage (including ADLS Gen2), not Azure Files or Tables.
Question 10
A company named Contoso, Ltd. has an Azure Active Directory (Azure AD) tenant that is integrated with Microsoft 365 and an Azure subscription.
Contoso has an on-premises identity infrastructure. The infrastructure includes servers that run Active Directory Domain Services (AD DS) and Azure AD Connect.
Contoso has a partnership with a company named Fabrikam. Inc. Fabrikam has an Active Directory forest and a Microsoft 365 tenant. Fabrikam has the same on- premises identity infrastructure components as Contoso.
A team of 10 developers from Fabrikam will work on an Azure solution that will be hosted in the Azure subscription of Contoso. The developers must be added to the Contributor role for a resource group in the Contoso subscription.
You need to recommend a solution to ensure that Contoso can assign the role to the 10 Fabrikam developers. The solution must ensure that the Fabrikam developers use their existing credentials to access resources
What should you recommend?
A. In the Azure AD tenant of Contoso. create cloud-only user accounts for the Fabrikam developers.
B. Configure a forest trust between the on-premises Active Directory forests of Contoso and Fabrikam.
C. Configure an organization relationship between the Microsoft 365 tenants of Fabrikam and Contoso.
D. In the Azure AD tenant of Contoso, create guest accounts for the Fabnkam developers.
Show Answer
Correct Answer: D
Explanation: Create guest accounts for the Fabrikam developers in Contoso’s Azure AD tenant using Azure AD B2B collaboration. Contoso can assign those guest users the Contributor role on the resource group, and they can sign in with their existing Fabrikam credentials.
Question 11
HOTSPOT -
You are planning an Azure Storage solution for sensitive data. The data will be accessed daily. The dataset is less than 10 GB.
You need to recommend a storage solution that meets the following requirements:
✑ All the data written to storage must be retained for five years.
✑ Once the data is written, the data can only be read. Modifications and deletion must be prevented.
✑ After five years, the data can be deleted, but never modified.
✑ Data access charges must be minimized.
What should you recommend? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
Show Answer
Correct Answer: Storage account type: General purpose v2 with Hot access tier for blobs
Configuration: Container access policy
Explanation: The Hot tier minimizes access charges for data read daily. A container-level time-based immutability policy prevents blob modification and deletion for five years; after retention expires, blobs can be deleted.
$19
Get all 272 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.
