DojoTutorials - Revieew Mode Set 3 Flashcards
Your company has an existing subscription in Azure.
You provisioned an Azure Storage account named TutorialsDojoAccount and then created a file share named TDShare.
You need to create a script that will allow you to connect to your file share.
What is the UNC path of the file share?
A. \TutorialsDojoAccount.file.core.windows.net\TDShare
B.\file.core.windows.net.TutorialsDojoAccount\TDShare
C. \TutorialsDojoAccount.TDShare\file.core.windows.net
D. \TDShare.file.core.windows.net\TutorialsDojoAccount
A. \TutorialsDojoAccount.file.core.windows.net\TDShare
Explanation:
Azure Files enables you to set up highly available network file shares that can be accessed by using the standard Server Message Block (SMB) protocol. That means that multiple VMs can share the same files with both read and write access. You can also read the files using the REST interface or the storage client libraries.
One thing that distinguishes Azure Files from files on a corporate file share is that you can access the files from anywhere in the world using a URL that points to the file and includes a shared access signature (SAS) token. You can generate SAS tokens; they allow specific access to a private asset for a specific amount of time.
File shares can be used for many common scenarios:
- Many on-premises applications use file shares. This feature makes it easier to migrate those applications that share data to Azure. If you mount the file share to the same drive letter that the on-premises application uses, the part of your application that accesses the file share should work with minimal, if any, changes.
- Configuration files can be stored on a file share and accessed from multiple VMs. Tools and utilities used by multiple developers in a group can be stored on a file share, ensuring that everybody can find them and that they use the same version.
- Resource logs, metrics, and crash dumps are just three examples of data that can be written to a file share and processed or analyzed later.
About Azure file share backup - Azure Backup | Microsoft Docs
Azure Files is Microsoft’s easy-to-use cloud file system. Azure file shares can be seamlessly used in Windows and Windows Server.
In order to use an Azure file share outside of the Azure region it is hosted in, such as on-premises or in a different Azure region, the OS must support SMB 3.0. You can use Azure file shares on a Windows installation that is running either in an Azure VM or on-premises.
The Azure File Share UNC path format is:
\<storageAccountName>.file.core.windows.net\<File></File></storageAccountName>
For example:
\StoragePhilippines.file.core.windows.net\ElNidoPalawanFileShare
Hence, the correct answer is:
\TutorialsDojoAccount.file.core.windows.net\TDShare
References:
https://docs.microsoft.com/en-us/azure/storage/files/storage-files-introduction
https://docs.microsoft.com/en-us/azure/storage/files/storage-how-to-use-files-windows
Your company has an Azure Subscription that contains an Azure Container named TDContainer.
You are tasked with deploying a new Azure container instance that will run a custom-developed .NET application requiring persistent storage for operation.
You need to create a storage service that will meet the requirements for TDContainer.
What should you use?
A. Azure Blob storage
B. Azure Table storage
C. Azure Queue storage
D. Azure Files
A. Azure Blob storage
Explanation:
Containers are becoming the preferred way to package, deploy, and manage cloud applications. Azure Container Instances offers the fastest and simplest way to run a container in Azure, without having to manage any virtual machines and without having to adopt a higher-level service.
Azure Container Instances is a solution for any scenario that can operate in isolated containers, without orchestration. Run event-driven applications, quickly deploy from your container development pipelines, and run data processing and build jobs.
Containers offer significant startup benefits over virtual machines (VMs). Azure Container Instances can start containers in Azure in seconds, without the need to provision and manage VMs.
Bring Linux or Windows container images from Docker Hub, a private Azure container registry, or another cloud-based docker registry. Azure Container Instances caches several common base OS images, helping speed deployment of your custom application images.
By default, Azure Container Instances are stateless. If the container crashes or stops, all of its states are lost. To persist state beyond the lifetime of the container, you must mount a volume from an external store. Azure Container Instances can mount an Azure file share created with Azure Files.
Azure Files offers fully managed file shares hosted in Azure Storage that are accessible via the industry standard Server Message Block (SMB) protocol. Using an Azure file share with Azure Container Instances provides file-sharing features similar to using an Azure file share with Azure virtual machines.
Azure Disks or Files are commonly used to provide persistent volumes for Azure Container Instances and Azure VMs.
Hence, the correct answer is: Azure Files.
Azure Queue Storage is incorrect because this service is simply used for storing large numbers of messages to enable communication between components of a distributed application.
Azure Table Storage and Azure Blob Storage are both incorrect because Azure Container Services does not support direct integration of these services.
Your company has an Azure subscription that contains an Azure Storage account named tutorialsdojoaccount.
There is a requirement to copy a virtual machine image to a container named tdimage from your on-premises datacenter. You need to provision an Azure Container instance to host the container image.
Which AzCopy command should you run?
Select the correct answer from the drop-down list of options. Each correct selection is worth one point.
AzCopy \_\_\_\_\_\_\_ A. Copy B. Make C. Sync
“https://tutorialsdojoaccount.____.core.windows.net/tdimage”
A. File
B. Table
C. Blob
B. Make
C. Blob
Explanation:
Azure Blob storage is Microsoft’s object storage solution for the cloud. Blob storage is optimized for storing massive amounts of unstructured data. Unstructured data is data that doesn’t adhere to a particular data model or definition, such as text or binary data.
Blob storage is designed for:
– Serving images or documents directly to a browser.
– Storing files for distributed access.
– Streaming video and audio.
– Writing to log files.
– Storing data for backup and restore disaster recovery, and archiving.
– Storing data for analysis by an on-premises or Azure-hosted service.
A container organizes a set of blobs, similar to a directory in a file system. A storage account can include an unlimited number of containers, and a container can store an unlimited number of blobs. VHD files can be used to create custom images that can be stored in an Azure Blob container, which are used to provision virtual machines.
AzCopy is a command-line utility that you can use to copy blobs or files to or from a storage account. The azcopy make command is commonly used to create a container or a file share.
The correct syntax in creating a blob container is:
azcopy make “https://[account-name].blob.core.windows.net/[top-level-resource-name]”
For example:
azcopy make “https://myaccount.blob.core.windows.net/mycontainer/myblob”
Therefore, the correct answers are:
AzCopy = Make
https://tutorialsdojoaccount.____.core.windows.net/tdimage = Blob
Your company has a virtual network named TDVnet1 and a policy-based virtual network gateway named TD1 in your Azure subscription.
You have users that need to access TDVnet1 from a remote location.
Which two actions should you do so your users can establish a point-to-site connection to TDVnet1?
A. Download and install the VPN client configuration file B. Deploy a gateway subnet C. Reset TD1 D. Deploy a route-based VPN gateway E. Delete TD1
D. Deploy a route-based VPN gateway
E. Delete TD1
Explanation:
Point-to-Site (P2S) VPN connection allows you to create a secure connection to your virtual network from an individual client computer. A P2S connection is established by starting it from the client computer. This solution is useful for telecommuters who want to connect to Azure VNets from a remote location, such as from home or a conference. P2S VPN is also a useful solution to use instead of S2S VPN when you have only a few clients that need to connect to a VNet.
When you configure a point-to-site VPN connection, you must use a route-based VPN type for your gateway. Policy-based VPN type for point-to-site VPN connection is not supported by Azure.
If you create a policy-based VPN type as your gateway, you need to delete it and deploy a route-based VPN gateway instead.
Hence, the correct answers are:
– Delete TD1
– Deploy a route-based VPN gateway
The option that says: Deploy a gateway subnet is incorrect. A gateway subnet is a prerequisite when you create a point-to-site VPN connection and since there is already an existing point-to-site VPN connection in your Azure subscription, you don’t have to deploy one again.
The option that says: Reset TD1 is incorrect. Resetting TD1 will not work since it is a policy-based VPN type. Take note that you need a route-based VPN type for point-to-site VPN connections.
The option that says: Download and install the VPN client configuration file is incorrect. Even if you have downloaded and installed the VPN client configuration file, the users still won’t be able to connect to TDVnet1 because TD1 is a policy-based VPN type. You have to delete TD1 first and deploy a new route-based VPN gateway.
Your company has an Azure subscription that contains a virtual machine named TD1 and a virtual network named TDVnet1.
You have an on-premises Server Message Block (SMB) file server named FileServer1.
There is a requirement to connect TD1 to FileServer1.
What should you create?
A. Create an Azure virtual network peering
B. Create a Microsoft Entra Connect Sync
C. Create an Azure Virtual Network Gateway
D. Create an Azure Application Gateway
C. Create an Azure Virtual Network Gateway
Explanation:
Azure Virtual Network (VNet) is the fundamental building block for your private network in Azure. VNet enables many types of Azure resources, such as Azure Virtual Machines (VM), to securely communicate with each other, the Internet, and on-premises networks. VNet is similar to a traditional network that you’d operate in your own data center but brings with it additional benefits of Azure’s infrastructure, such as scale, availability, and isolation.
An Azure Virtual Network Gateway or VPN Gateway is a specific type of virtual network gateway that is used to send encrypted traffic between an Azure virtual network and an on-premises location over the public Internet.
You can also use a VPN gateway to send encrypted traffic between Azure virtual networks over the Microsoft network.
Each virtual network can have only one VPN gateway. However, you can create multiple connections to the same VPN gateway. When you create multiple connections to the same VPN gateway, all VPN tunnels share the available gateway bandwidth.
A site-to-site VPN gateway connection is used to connect your on-premises network to an Azure virtual network over an IPsec/IKE (IKEv1 or IKEv2) VPN tunnel.
Hence, the correct answer is: Create an Azure Virtual Network Gateway.
Your company has an Azure subscription named TDSubscription1 that contains the following resources:
TDVnet1 10.1.0.0/16 (subnet 10.1.0.0/24 and 10.1.1.0/24) Peered to TDVnet2
TDVneet2 10.10.0.0/16 (Subnet 10.10.0.0/24) Peered to TDVnet1
You recently added a new address space 10.30.0.0/16 to TDVnet1.
What should you do next?
A. Delete TDVnet2.
B. Re-create the peering between TDVnet1 and TDVnet2.
C. Delete the peering between TDVnet1 and TDVnet2.
D. Sync the peering between TDVnet1 and TDVnet2.
D. Sync the peering between TDVnet1 and TDVnet2.
Explanation:
You can resize the address space of Azure virtual networks that are peered without incurring any downtime on the currently peered address space. This feature is useful when you need to resize the virtual network’s address space after scaling your workloads. After resizing the address space, all that is required is for peers to be synced with the new address space changes. Resizing works for both IPv4 and IPv6 address spaces.
Addresses can be resized in the following ways:
– Modifying the address range prefix of an existing address range (For example, changing 10.1.0.0/16 to 10.1.0.0/18).
– Adding address ranges to a virtual network.
– Deleting address ranges from a virtual network.
– Resizing of address space is supported cross-tenant.
Hence, the correct answer is: Sync the peering between TDVnet1 and TDVnet2.
The statement that says: Delete TDVnet2 is incorrect because you can add an address space to your virtual network without deleting it.
The following statements are incorrect because you do not need to delete and re-create the peering when you add an address space to an existing virtual network peering. All you have to do is sync the peering after you have added an address space.
– Delete the peering between TDVnet1 and TDVnet2
– Re-create the peering between TDVnet1 and TDVnet2
Your Azure subscription contains a fleet of virtual machines.
You recently deployed an Azure bastion named TD1 with an SKU of Basic and a subnet size of /26.
There is a requirement that more than 90 users will concurrently use TD1. You need to be able to accommodate the number of users that will be accessing TD1. The solution must minimize administrative effort.
What should you do first?
A. Upgrade the SKU of TD1
B. Increase the instance count of TD1.
C. Deploy a new bastion server with an SKU of Standard
D. Increase the server size of TD1.
A. Upgrade the SKU of TD1
Explanation:
Two instances are created when you configure Azure Bastion using the Basic SKU. Using the Standard SKU, you can specify the number of instances. This is called host scaling.
Each instance can support 20 concurrent RDP connections and 40 concurrent SSH connections for medium workloads. The number of connections per instance depends on your actions when connected to the client VM. For example, if you are doing something data-intensive, it creates a more significant load for the instance to process. Once the concurrent sessions are exceeded, an additional scale unit (instance) is required.
Remember that you can only use host scaling if your bastion server has an SKU of Standard
To accommodate additional concurrent client connections, first, you need to upgrade the SKU of TD1 from Basic to Standard(after upgrading to Standard, you can not revert back to Basic SKU) After that, you can increase the instance count of TD1 to whatever number of servers are required to accommodate the 90 users.
Hence, the correct answer is: Upgrade the SKU of TD1.
The option that says: Deploy a new bastion server with an SKU of Standard is incorrect because there is no need to deploy a new bastion server with an SKU of Standard. You can upgrade the SKU of TD1 to Standard. One of the requirements is that your solution must minimize administrative effort.
The option that says: Increase the instance count of TD1 is incorrect because you will only be able to increase the instance count if TD1 is already using an SKU of Standard. Take note that the question asks what you will do first.
The option that says: Increase the server size of TD1 is incorrect because there is no option to increase the server size of a bastion server. If you need more computing power, you can increase the instance count of the bastion server. Remember that you need to use an SKU of Standard before being able to use host scaling.
You have an Azure subscription that contains an Azure DNS zone named tutorialsdojo.com.
There is a requirement to delegate a subdomain named portal.tutorialsdojo.com to another Azure DNS zone.
What solution would satisfy the requirement?
A. Navigate to tutorialsdojo.com and add a PTR record named portal.
B. Navigate to tutorialsdojo.com and add an NS record named portal.
C. Navigate to tutorialsdojo.com and add a CNAME record named portal.
D. Navigate to tutorialsdojo.com and add a TXT record named portal.
B. Navigate to tutorialsdojo.com and add an NS record named portal.
Explanation:
Azure DNS is a hosting service for DNS domains that provides name resolution by using Microsoft Azure infrastructure. By hosting your domains in Azure, you can manage your DNS records by using the same credentials, APIs, tools, and billing as your other Azure services.
You can use the Azure portal to delegate a DNS subdomain. For example, if you own the tutorialsdojo.com domain, you can delegate a subdomain called portal to another, separate zone that you can administer separately from the tutorialsdojo.com zone.
To delegate an Azure DNS subdomain, you must first delegate your public domain to Azure DNS. Once your domain is delegated to your Azure DNS zone, you can delegate your subdomain.
You can delegate a subdomain by doing the following:
- Create a new Azure DNS zone named portal.tutorialsdojo.com. Copy down the four nameservers as you will need them for step 2.
- Navigate to the tutorialsdojo.com DNS zone and add an NS record named portal. Under records, enter the four nameservers from portal.tutorialsdojo.com and click ok.
- To verify your work, open a PowerShell window and type nslookup portal.tutorialsdojo.com
Hence, this statement is correct: Navigate to tutorialsdojo.com and add an NS record named portal.
The following statements are incorrect because PTR, CNAME, and TXT records are not used to delegate an Azure DNS subdomain.
– Navigate to tutorialsdojo.com and add a PTR record named portal.
– Navigate to tutorialsdojo.com and add a CNAME record named portal.
– Navigate to tutorialsdojo.com and add a TXT record named portal.
Your company has an Azure subscription named ManilaSubscription that contains multiple virtual machines.
The subscription has a user named ManilaUser01 which has the following roles:
Backup Reader Storage Blob Data Contributor DevTest Labs User
You need to ensure that ManilaUser01 can assign a Reader role to all the users in the subscription.
What role should you assign?
A. Assign the Security Reader role.
B. Assign the User Access Administrator role.
C. Assign the Security Admin role.
D. Assign the Virtual Machine Contributor role.
B. Assign the User Access Administrator role.
Explanation:
The four fundamental Azure roles are Owner, Contributor, Reader, and User Access Administrator. To assign a Reader role to all the users in the Azure subscription, you must grant the user a User Access Administrator role. This role allows you to manage user access to the Azure resources.
Hence, the correct answer is: Assign the User Access Administrator role.
The option that says: Assign the Security Reader role is incorrect because this role only allows the user to view permissions in the Security Center.
The option that says: Assign the Virtual Machine Contributor role is incorrect because this role just lets you manage virtual machines. Take note that this role doesn’t allow you to access virtual machines directly nor assign a Reader role to all the users in the subscription.
The option that says: Assign the Security Admin role is incorrect. This role has the same permissions as the Security Reader role. The only difference is that it can update the security policy and dismiss alerts and recommendations.
You plan to automate the deployment of Windows Servers using a virtual machine scale set.
You need to make sure that the web components are installed in the virtual machines.
Which two actions should you perform?
A. Create a policy.
B. Create a new scale set.
C. Create a configuration script.
D. Configure the extensionProfile section of the ARM template.
E. Create an automation account.
C. Create a configuration script.
D. Configure the extensionProfile section of the ARM template
Explanation:
The Custom Script Extension downloads and executes scripts on Azure virtual machines. This extension is useful for post-deployment configuration, software installation, or any other configuration or management tasks.
Hence, the correct answers are:
– Create a configuration script.
– Configure the extensionProfile section of the ARM template.
The option that says: Create an automation account is incorrect because an automation account wouldn’t help you automatically install web components. You still need to create a configuration script and extensionProfile in the ARM template.
The option that says: Create a policy is incorrect because this option only evaluates resources in Azure. Take note that you don’t need to create a policy to install web components.
The option that says: Create a new scale set is incorrect because this wouldn’t install the required web components. Instead of creating a new scale set, you should use a custom script extension to install the web components in the VMs.
Your company has an Azure Subscription that contains an Azure Kubernetes Service (AKS) cluster and a Microsoft Entra tenant named tutorialsdojo.com.
You received a report that the system administrator is unable to grant access to Microsoft Entra users who need to use the cluster.
You need to grant the users in tutorialsdojo.com access to the cluster.
What should you implement?
A. Configure external collaboration settings.
B. Create an OAuth 2.0 authorization endpoint.
C. Add a namespace.
D. Create a new AKS cluster.
B. Create an OAuth 2.0 authorization endpoint.
Explanation:
The OAuth 2.0 authorization code grant can be used in apps that are installed on a device to gain access to protected resources. As shown in the image above, the Microsoft Entra ID client application will use kubectl to sign in users with OAuth 2.0 device authorization grant flow. Microsoft Entra ID will provide an access_token, id_token, and a refresh_token then the user will request to kubectl using an access_token from kubeconfig. After validation, the API will perform an authorization decision based on the Kubernetes Role/RoleBinding. Once authorized, the API server returns a response to kubectl.
Hence, the correct answer is: Create an OAuth 2.0 authorization endpoint.
The option that says: Configure external collaboration settings is incorrect because external collaboration settings only let you turn guest invitations on or off for different types of users in your organization. This option wouldn’t help you grant the users in tutorialsdojo.com access to the cluster.
The option that says: Create a new AKS cluster is incorrect because a cluster is just a set of nodes that run containerized applications. Creating a new cluster is not necessary. You need to create an authorization endpoint to grant the users access to the domain name.
The option that says: Add a namespace is incorrect because a namespace only divides cluster resources between multiple users. Remember that users can only interact with resources within their assigned namespaces. To grant the users in tutorialsdojo.com access to the cluster, you should create an OAuth authorization endpoint.
Your company has a virtual network that contains a MySQL database hosted on a virtual machine.
You created a web app named tutorialsdojo-webapp using the Azure App service.
You need to make sure that tutorialsdojo-webapp can fetch the data from the MySQL database.
What should you implement?
A. Create an internal load balancer.
B. Enable VNet Integration and connect the web app to the virtual network.
C. Peer the virtual network to another virtual network.
D. Create an Azure Application Gateway.
B. Enable VNet Integration and connect the web app to the virtual network.
Explanation:
With Azure Virtual Network (VNets), you can place many of your Azure resources in a non-internet-routable network. The VNet Integration feature enables your apps to access resources in or through a VNet. VNet Integration doesn’t enable your apps to be accessed privately.
Azure App Service has two variations on the VNet Integration feature:
– The multitenant systems support the full range of pricing plans except for Isolated.
– The App Service Environment, which deploys into your VNet and supports Isolated pricing plan apps.
Hence, the correct answer is: Enable VNet Integration and connect the web app to the virtual network.
The option that says: Create an internal load balancer is incorrect because this option only distributes the traffic. An internal load balancer is mainly used to load balance traffic inside a virtual network.
The option that says: Peer the virtual network to another virtual network is incorrect because virtual network peering wouldn’t help the web app access the virtual machine.
The option that says: Create an Azure Application Gateway is incorrect because the distribution of web traffic is not needed in the scenario. An Azure Application Gateway is just a web traffic load balancer that enables you to manage traffic to your web applications. Take note that the only requirement is to ensure that tutorialsdojo-webapp can access the data from the MySQL database hosted on a virtual machine.
Your company has two Azure virtual networks named TDVNet1 and TDVNet2 in Central US region. A virtual machine named TD-VM1 is running in TDVNet1 while the other virtual network has a virtual machine named TD-VM2.
A web application is hosted on TD-VM1 and the data is retrieved and processed by TD-VM2.
Several users reported that the web application has a sluggish performance.
You are instructed to track the average round-trip time (RTT) of the packets from TD-VM1 to TD-VM2.
Which of the following options can satisfy the given requirement?
A. Connection Monitor
B. Connection Troubleshoot
C. IP flow verify
D. NSG flow logs
A. Connection Monitor
Explanation:
Azure Network Watcher provides tools to monitor, diagnose, view metrics, and enable or disable logs for resources in an Azure virtual network. Network Watcher is designed to monitor and repair the network health of IaaS (Infrastructure-as-a-Service) products which includes Virtual Machines, Virtual Networks, Application Gateways, Load balancers, etc.
In this scenario, you can use Connection Monitor to track the average round-trip time (RTT) of the packets from TD-VM1 to TD-VM2. In Azure Network Watcher, Connection Monitor provides unified end-to-end connection monitoring. The Connection Monitor feature also supports hybrid and Azure cloud deployments.
Benefits of using the Connection Monitor:
– Unified, intuitive experience for Azure and hybrid monitoring needs
– Cross-region, cross-workspace connectivity monitoring
– Higher probing frequencies and better visibility into network performance
– Faster alerting for your hybrid deployments
– Support for connectivity checks that are based on HTTP, TCP, and ICMP
– Metrics and Log Analytics support for both Azure and non-Azure test setups
Hence, the correct answer is Connection Monitor.
IP flow verify is incorrect because this feature only looks at the rules for all Network Security Groups (NSGs) applied to the network interface. It is stated in the scenario that you must track the packets from TD-VM1 to TD-VM2. IP flow verify is not capable of providing the average round-trip time of the packets from the source to the destination.
Connection Troubleshoot is incorrect because it simply checks connectivity between source and destination. Take note that you need to track the average round-trip time of the packets from VM1 to VM2. Therefore, you need to use Connection Monitor to analyze the end-to-end connection and not the Connection Troubleshoot operation.
NSG flow logs is incorrect because it only allows you to log information about IP traffic flowing (ingress and egress) through an NSG. Take note that you can’t use NSG flow logs to track the average RTT of the packets from TD-VM1 to TD-VM2. You need to use Connection Monitor to provide unified end-to-end connection monitoring.
You are managing an Azure subscription that contains a resource group named TD-RG1 which has a virtual machine named TD-VM1.
TD-VM1 has services that will deploy new resources on TD-RG1.
You need to make sure that the services running on TD-VM1 should be able to manage the resources in TD-RG1 using its identity.
Which of the following actions should you do first?
A. Configure the managed identity of TD-VM1.
B. Configure the access control of TD-RG1.
C. Configure the security settings of TD-RG1.
D. Configure the access control of TD-VM1.
A. Configure the managed identity of TD-VM1.
Explanation:
Microsoft Entra ID is a cloud-based identity and access management service that enables your employees access external resources. Example resources include Microsoft 365, the Azure portal, and thousands of other SaaS applications.
Microsoft Entra ID also helps them access internal resources like apps on your corporate intranet, and any cloud apps developed for your own organization.
There are two types of managed identities:
– System-assigned: some Azure services allow you to enable a managed identity directly on a service instance. When you enable a system-assigned managed identity, an identity is created in Microsoft Entra ID that is tied to the lifecycle of that service instance. So when the resource is deleted, Azure automatically deletes the identity for you. By design, only that Azure resource can use this identity to request tokens from Microsoft Entra ID.
– User-assigned: you may also create a managed identity as a standalone Azure resource. You can create a user-assigned managed identity and assign it to one or more instances of an Azure service. In the case of user-assigned managed identities, the identity is managed separately from the resources that use it.
In this scenario, you can use the system-assigned managed identity. Take note that this identity is restricted to only one resource. You can grant permissions to the managed identity by using Azure RBAC. The managed identity is authenticated with Microsoft Entra ID, so you don’t have to store any credentials.
Hence, the correct answer is: Configure the managed identity of TD-VM1.
The option that says: Configure the security settings of TD-RG1 is incorrect because it only provides security recommendations and security alerts for your resource group. As per the scenario, you need to ensure that the services running on TD-VM1 are able to manage the resources in TD-RG1 using its identity. Therefore, you need to configure the managed identity settings of TD-VM1.
The options that say: Configure the access control of TD-VM1 and Configure the access control of TD-RG1 are incorrect because these are only adding role assignments to an Azure resource. A role assignment is a process of attaching a role definition to a user, group, or service principal to provide access to a specific resource. Remember that access is granted by creating a role assignment, and access is revoked by removing a role assignment. You have to configure a managed identity instead.
Your company has 12 peered virtual networks in your Azure subscription.
You plan to deploy a network security group for each virtual network.
There is a compliance requirement that port 80 should be automatically blocked between virtual networks whenever a new network security group is created. The solution must minimize administrative effort.
Solution: You create a security rule that denies incoming port 80 traffic.
Does the solution meet the goal?
A. Yes
B. No
B. No
Explanation:
Azure Network Security Group is used to filter network traffic to and from Azure resources in an Azure virtual network. A network security group contains security rules that allow or deny inbound network traffic to, or outbound network traffic from, several types of Azure resources. For each rule, you can specify source and destination, port, and protocol.
It is stated in the scenario that blocking port 80 should be done automatically whenever a new network security group is created. By creating a rule manually, it becomes quite cumbersome to configure as you need to create a security rule for every network security group you create. It’s best practice to always automate your security processes to avoid administrative overhead.
You should use a custom policy definition in order to automate the requirement.
Hence, the correct answer is: No.
