HOTSPOT
-
You have an Azure subscription. The subscription contains 100 virtual machines that run Windows Server 2022 and have the Azure Monitor Agent installed.
You need to recommend a solution that meets the following requirements:
• Forwards JSON-formatted logs from the virtual machines to a Log Analytics workspace
• Transforms the logs and stores the data in a table in the Log Analytics workspace
What should you include in the recommendation? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: An Azure Monitor data collection endpoint
A KQL query
Explanation: JSON logs from Azure Monitor Agent–enabled VMs are forwarded to Log Analytics through a Data Collection Endpoint (used by Data Collection Rules). Log transformation and ingestion-time shaping are performed in the DCR using Kusto Query Language (KQL), which supports transforming JSON data before it’s stored in a table.
Question 33
HOTSPOT -
You have an Azure subscription.
You plan to deploy five storage accounts that will store block blobs and five storage accounts that will host file shares. The file shares will be accessed by using the SMB protocol.
You need to recommend an access authorization solution for the storage accounts. The solution must meet the following requirements:
• Maximize security.
• Prevent the use of shared keys.
• Whenever possible, support time-limited access.
What should you include in the solution? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: For the blobs:
A user delegation shared access signature (SAS) only
For the file shares:
Azure AD credentials
Explanation: Blob Storage supports user delegation SAS, which is signed with Azure AD (no shared keys) and supports time-limited access. Stored access policies are not supported with user delegation SAS. Azure Files accessed over SMB supports Azure AD–based authentication (via AD DS/Azure AD DS), which maximizes security and avoids shared keys; user delegation SAS is not supported for Azure Files.
Question 34
HOTSPOT
-
You have an Azure subscription that contains multiple storage accounts.
You assign Azure Policy definitions to the storage accounts.
You need to recommend a solution to meet the following requirements:
• Trigger on-demand Azure Policy compliance scans.
• Raise Azure Monitor non-compliance alerts by querying logs collected by Log Analytics.
What should you recommend for each requirement? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: The Azure Command-Line Interface (CLI)
Azure activity logs
Explanation: On-demand Azure Policy compliance scans are triggered using the Azure CLI (or PowerShell/REST), not from the portal or templates. To raise non-compliance alerts via Log Analytics, Azure Policy events must be sent through diagnostic settings on the Azure Activity Logs, which can then be queried in Log Analytics for Azure Monitor alerts.
Question 35
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your company plans to deploy various Azure App Service instances that will use Azure SQL databases. The App Service instances will be deployed at the same time as the Azure SQL databases.
The company has a regulatory requirement to deploy the App Service instances only to specific Azure regions. The resources for the App Service instances must reside in the same region.
You need to recommend a solution to meet the regulatory requirement.
Solution: You recommend using an Azure Policy initiative to enforce the location of resource groups.
Does this meet the goal?
A. Yes
B. No
Show Answer
Correct Answer: B
Explanation: Enforcing the location of resource groups does not control the deployment region of the resources inside them. Azure resources such as App Service and Azure SQL Database can be created in regions different from their resource group. Therefore, a policy that only enforces resource group location does not ensure App Service instances are deployed only to specific Azure regions or that related resources reside in the same region.
Question 36
You have an Azure subscription. The subscription contains a tiered app named App1 that is distributed across multiple containers hosted in Azure Container Instances.
You need to deploy an Azure Monitor monitoring solution for App. The solution must meet the following requirements:
• Support using synthetic transaction monitoring to monitor traffic between the App1 components.
• Minimize development effort.
What should you include in the solution?
A. Network insights
B. Application Insights
C. Container insights
D. Log Analytics Workspace insights
Show Answer
Correct Answer: B
Explanation: Application Insights, part of Azure Monitor, supports synthetic transaction monitoring (availability tests) to simulate and track traffic between application components. It integrates easily with Azure services, including container-based apps, and requires minimal development effort compared to lower-level logging or container/network-focused insights.
Question 37
DRAG DROP -
You plan to deploy an infrastructure solution that will contain the following configurations:
• External users will access the infrastructure by using Azure Front Door.
• External user access to the backend APIs hosted in Azure Kubernetes Service (AKS) will be controlled by using Azure API Management.
• External users will be authenticated by an Azure AD B2C tenant that uses OpenID Connect-based federation with a third-party identity provider.
Which function does each service provide? To answer, drag the appropriate functions to the correct services. Each function may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Front Door:
Protection against Open Web Application Security Project (OWASP) vulnerabilities
API Management:
Validation of Azure B2C JSON Web Tokens (JWTs)
Explanation: Azure Front Door provides a Web Application Firewall (WAF) that protects against OWASP vulnerabilities. Azure API Management sits in front of the AKS-hosted APIs and is responsible for enforcing API-level security, including validating Azure AD B2C-issued JWTs. IP filtering on a per-API level is a capability of API Management but is not required by the scenario and therefore not selected.
Question 38
You have an Azure subscription that contains the resources shown in the following table.
You need to recommend a load balancing solution that will distribute incoming traffic for VMSS1 across NVA1 and NVA2. The solution must minimize administrative effort.
What should you include in the recommendation?
A. Gateway Load Balancer
B. Azure Front Door
C. Azure Application Gateway
D. Azure Traffic Manager
Show Answer
Correct Answer: A
Explanation: Gateway Load Balancer is specifically designed to distribute traffic to Network Virtual Appliances (NVAs) at layer 4 with minimal configuration. It natively supports transparent traffic insertion and scaling of NVAs without requiring user-defined routes or complex chaining, which minimizes administrative effort. The other options target web (Application Gateway), global HTTP(S) (Front Door), or DNS-based load balancing (Traffic Manager) and are not suited for NVA traffic distribution.
Question 39
You have 12 Azure subscriptions and three projects. Each project uses resources across multiple subscriptions.
You need to use Microsoft Cost Management to monitor costs on a per project basis. The solution must minimize administrative effort.
Which two components should you include in the solution? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
A. budgets
B. resource tags
C. custom role-based access control (RBAC) roles
D. management groups
E. Azure boards
Show Answer
Correct Answer: A, B
Explanation: To monitor costs per project across multiple Azure subscriptions with minimal administrative effort, you should use resource tags and budgets. Resource tags allow you to label resources by project regardless of which subscription they are in, and Microsoft Cost Management can aggregate and filter costs based on those tags. Budgets can then be created using those tags to monitor spending and trigger alerts per project. Management groups organize subscriptions but do not solve per-project cost tracking when projects span multiple subscriptions, and the other options are not directly related to cost monitoring.
Question 40
HOTSPOT
-
You have an Azure subscription that contains the resources shown in the following table:
Log files from App1 are registered to App1Logs. An average of 120 GB of log data is ingested per day.
You configure an Azure Monitor alert that will be triggered if the App1 logs contain error messages.
You need to minimize the Log Analytics costs associated with App1. The solution must meet the following requirements:
• Ensure that all the log files from App1 are ingested to App1Logs.
• Minimize the impact on the Azure Monitor alert.
Which resource should you modify, and which modification should you perform? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: Workspace1
Change to a commitment pricing tier
Explanation: Log ingestion costs are controlled at the Log Analytics workspace level. With ~120 GB/day ingestion, switching Workspace1 from pay-as-you-go to a commitment tier (starting at 100 GB/day) reduces costs while still ingesting all logs and fully supporting Azure Monitor alerts. Basic Logs or a daily cap could affect alerting or data completeness.
Question 41
HOTSPOT -
You have an Azure subscription that contains 50 Azure SQL databases.
You create an Azure Resource Manager (ARM) template named Template1 that enables Transparent Data Encryption (TDE).
You need to create an Azure Policy definition named Policy1 that will use Template1 to enable TDE for any noncompliant Azure SQL databases.
How should you configure Policy1? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Show Answer
Correct Answer: DeployIfNotExists
The role-based access control (RBAC) roles required to perform the remediation task
Explanation: To automatically enable TDE using an ARM template, the policy must use the DeployIfNotExists effect. This effect requires the policy definition to include roleDefinitionIds specifying the RBAC roles needed for remediation. Managed identity and scope are configured at assignment, not in the definition.
$19
Get all 273 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.