Examtopics Flashcards

Question

Your company has two on-premises servers named SRV01 and SRV02. Developers have created an application that runs on SRV01. The application calls a service on SRV02 by IP address. You plan to migrate the application on Azure virtual machines (VMs). You have configured two VMs on a single subnet in an Azure virtual network. You need to configure the two VMs with static internal IP addresses. What should you do?

Answer 1

Run the Set-AzureStaticVNetIP PowerShell cmdlet. Specify a static internal IP for a previously created VM If you want to set a static IP address for a VM that you previously created, you can do so by using the following cmdlets. If you already set an IP address for the VM and you want to change it to a different IP address, you'll need to remove the existing static IP address before running these cmdlets. See the instructions below to remove a static IP. For this procedure, you'll use the Update-AzureVM cmdlet. The Update-AzureVM cmdlet restarts the VM as part of the update process. The DIP that you specify will be assigned after the VM restarts. In this example, we set the IP address for VM2, which is located in cloud service StaticDemo. Get-AzureVM -ServiceName StaticDemo -Name VM2 | Set-AzureStaticVNetIP -IPAddress 192.168.4.7 | Update-AzureVM

Answer 2

B. You can recover the files to any VM within the company's subscription.

Answer 3

Azure Monitor

Answer 4

Solution: You create a PowerShell script that runs the New-AzureADMSInvitation cmdlet for each external user. Use the New-AzureADMSInvitation cmdlet which is used to invite a new external user to your directory.

Answer 5

Network contributor on both. The Network Contributor role lets you manage networks, but not access them. Azure RBAC roles can be applied at three different scopes...management group, subscription, resource group and finally resource. So, LB1 and LB2 are resources that we want the Network Contributor role to manage, which by the way satisfies the principle of least privilege. When you apply the scope to the resource group, then it is applied to all the resources in the resource group which is not what we want. The question specifically referred to LB1 and LB2. These resources are atomic, therefore applying the scope to the two will affect just those two resources.

Answer 6

From contoso.com, create an OAuth 2.0 authorization endpoint.

Answer 7

a Microsoft 365 group that uses the Assigned membership type and a Microsoft 365 group that uses the Dynamic User membership type You can set expiration policy only for Office 365 groups in Azure Active Directory (Azure AD). Note: With the increase in usage of Office 365 Groups, administrators and users need a way to clean up unused groups. Expiration policies can help remove inactive groups from the system and make things cleaner. When a group expires, all of its associated services (the mailbox, Planner, SharePoint site, etc.) are also deleted. You can set up a rule for dynamic membership on security groups or Office 365 groups.

Answer 8

From Azure PowerShell, run the Set-AzMarketplaceTerms cmdlet

Answer 9

From the Directory role blade, modify the directory role

Answer 10

From the Licenses blade of Azure AD, assign a license

Answer 11

Deploy the IT Service Management Connector (ITSM) The IT Service Management Connector (ITSMC) allows you to connect Azure and a supported IT Service Management (ITSM) product/service, such as the Microsoft System Center Service Manager. With ITSMC, you can create work items in ITSM tool, based on your Azure alerts (metric alerts, Activity Log alerts and Log Analytics alerts).

Answer 12

Device settings from the Devices blade When you connect a Windows device with Azure AD using an Azure AD join, Azure AD adds the following security principles to the local administrators group on the device: ✑ The Azure AD global administrator role ✑ The Azure AD device administrator role ✑ The user performing the Azure AD join In the Azure portal, you can manage the device administrator role on the Devices page. To open the Devices page: 1. Sign in to your Azure portal as a global administrator or device administrator. 2. On the left navbar, click Azure Active Directory. 3. In the Manage section, click Devices. 4. On the Devices page, click Device settings. 5. To modify the device administrator role, configure Additional local administrators on Azure AD joined devices.

Answer 13

C. VM1, storage1, VNET1, VM1Managed, and RVAULT1 You can move a VM and its associated resources to a different subscription by using the Azure portal. You can now move an Azure Recovery Service (ASR) Vault to either a new resource group within the current subscription or to a new subscription. However you cannot move RVAULT1 to another region

Answer 14

C. Deploy the IT Service Management Connector (ITSM) The IT Service Management Connector (ITSMC) allows you to connect Azure and a supported IT Service Management (ITSM) product/service, such as the Microsoft System Center Service Manager. With ITSMC, you can create work items in ITSM tool, based on your Azure alerts (metric alerts, Activity Log alerts and Log Analytics alerts).

Answer 15

A. Device settings from the Devices blade When you connect a Windows device with Azure AD using an Azure AD join, Azure AD adds the following security principles to the local administrators group on the device: ✑ The Azure AD global administrator role ✑ The Azure AD device administrator role ✑ The user performing the Azure AD join In the Azure portal, you can manage the device administrator role on the Devices page. To open the Devices page: 1. Sign in to your Azure portal as a global administrator or device administrator. 2. On the left navbar, click Azure Active Directory. 3. In the Manage section, click Devices. 4. On the Devices page, click Device settings. 5. To modify the device administrator role, configure Additional local administrators on Azure AD joined devices

Answer 16

C. Stop the backup of SQLDB01 You can't delete a Recovery Services vault with any of the following dependencies: 1. You can't delete a vault that contains backup data. Once backup data is deleted, it will go into the soft deleted state. 2. You can't delete a vault that contains backup data in the soft deleted state.

Answer 17

B. Assign User1 the User Access Administrator role for VNet1 Any variations of Contributor role does not allow to grant roles to other users. Contributor can be understood as resource read/write permission. To assing roles to other users you need some variation of Owner to repurce or Administrator role. Roles do not exclude each other, so if you have Read and Contributor role, you're still a Contributor and gain nothing by removing Reader role

Answer 18

A. MX To verify your custom domain name (example) 1. Sign in to the Azure portal using a Global administrator account for the directory. 2. Select Azure Active Directory, and then select Custom domain names. 3. On the Fabrikam - Custom domain names page, select the custom domain name, Contoso. 4. On the Contoso page, select Verify to make sure your custom domain is properly registered and is valid for Azure AD. Use either the TXT or the MX record type. Note: There are several versions of this question in the exam. The question can have two correct answers: 1. MX 2. TXT

Answer 19

Correct Answer: B The Azure DevTest Labs is a role used for Azure DevTest Labs, not for Logic Apps. DevTest Labs User role only lets you connect, start, restart, and shutdown virtual machines in your Azure DevTest Labs. The Logic App Contributor role lets you manage logic app, but not access to them. It provides access to view, edit, and update a logic app.

Answer 20

Correct Answer: B You would need the Logic App Contributor role. Logic App Operator - Lets you read, enable, and disable logic apps, but not edit or update them. Logic App Contributor - Lets you create, manage logic apps, but not access to them.

Answer 21

Correct Answer: A The Contributor role can manage all resources (and add resources) in a Resource Group. Contributor role can create logic apps. Alternatively, we can use the Logic App Contributor role, which lets you manage logic app, but not access to them. It provides access to view, edit, and update a logic app.

Answer 22

1. B. 2. D. 3. C.

Answer 23

B. search in (Event) "error"

Answer 24

A. The App Service plan for WebApp1 remains in West Europe. Policy2 applies to WebApp1 You can move an app to another App Service plan, as long as the source plan and the target plan are in the same resource group and geographical region. The region in which your app runs is the region of the App Service plan it's in. However, you cannot change an App Service plan's region.

Answer 25

Correct Answer: A and E A: The customer sites are connected through VPNs, so an internal load balancer is enough. B: The customer sites are connected through VPNs, so there's no need for a public load balancer, an internal load balancer is enough. C: A CDN does not provide load balancing for applications, so it not relevant for this situation. D: Traffic manager is a DNS based solution to direct users' requests to the nearest (typically) instance and does not provide load balancing for this situation. E: Azure Application Gateway is a valid option, as it provides load balancing in addition to routing and security functions

Answer 26

Correct Answer: B Advisor helps you optimize and reduce your overall Azure spend by identifying idle and underutilized resources. You can get cost recommendations from the Cost tab on the Advisor dashboard.

Answer 27

A. You can adjust the guest user settings, their access, who can invite them from "External collaboration settings"

Answer 28

C. Assign the Global administrator role to User1, and then instruct User1 to configure access management for Azure resources No one is given default access to the root management group. Azure AD Global Administrators are the only users that can elevate themselves to gain access. Once they have access to the root management group, the global administrators can assign any Azure role to other users to manage it.

Answer 29

Correct Answer: A - Yes Your account must have any one of the following Azure roles at the subscription scope: Owner, Contributor, Reader, or Network Contributor. Network Contributor role - Lets you manage networks, but not access to them. Traffic Analytics is a cloud-based solution that provides visibility into user and application activity in cloud networks. Traffic analytics analyzes Network Watcher network security group (NSG) flow logs to provide insights into traffic flow in your Azure cloud.

Answer 30

Correct Answer: A Your account must have any one of the following Azure roles at the subscription scope: Owner, Contributor, Reader, or Network Contributor. Network Contributor role - Lets you manage networks, but not access to them. Traffic Analytics is a cloud-based solution that provides visibility into user and application activity in cloud networks. Traffic analytics analyzes Network Watcher network security group (NSG) flow logs to provide insights into traffic flow in your Azure cloud.

Answer 31

Correct Answer: B - NO Reader role - View all resources, but does not allow you to make any changes.

Answer 32

Correct Answer: C Contributor: Grants full access to manage all resources, but does not allow you to assign roles in Azure RBAC Incorrect Answers: A: Owner: Grants full access to manage all resources, including the ability to assign roles in Azure RBAC. B: Virtual Machine Contributor: Lets you manage virtual machines, but not access to them, and not the virtual network or storage account they're connected to. D: Virtual Machine Administrator Login: View Virtual Machines in the portal and login as administrator.

Answer 33

Correct Answer: A Managed identities for Azure resources provides Azure services with an automatically managed identity in Azure Active Directory. You can use this identity to authenticate to any service that supports Azure AD authentication, without having credentials in your code. You can enable and disable the system-assigned managed identity for VM using the Azure portal. RBAC manages who has access to Azure resources, what areas they have access to and what they can do with those resources. Examples of Role Based Access Control (RBAC) include: Allowing an app to access all resources in a resource group Policies on the other hand focus on resource properties during deployment and for already existing resources. As an example, a policy can be issued to ensure users can only deploy DS series VMs within a specified resource

Answer 34

Correct Answer: B When you delete a resource group, all of its resources are also deleted. Deleting a resource group deletes all of its template deployments and currently stored operations. As an administrator, you can lock a subscription, resource group, or resource to prevent other users in your organization from accidentally deleting or modifying critical resources. The lock overrides any permissions the user might have. You can't delete a vault that contains backup data. Once backup data is deleted, it will go into the soft deleted state. So you have to remove the lock on order to delete the VNET and delete the backups in order to delete the vault.

Answer 35

Correct Answer: A An NS record or (name server record) tells recursive name servers which name servers are authoritative for a zone. You can have as many NS records as you would like in your zone file. The benefit of having multiple NS records is the redundancy of your DNS service. You need to create a name server (NS) record for the zone.

Answer 36

A, E & F 1. Add the custom domain name to your directory 2. Add a DNS entry for the domain name at the domain name registrar 3. Verify the custom domain name in Azure AD

Answer 37

D. Modify the NS records in the DNS domain registrar. To ensure that records created in the contoso.com zone are resolvable from the internet, you need to modify the NS (Name Server) records in the DNS domain registrar. When you create a public Azure DNS zone named contoso.com, Azure assigns a set of NS records for that zone. These NS records specify the name servers responsible for handling DNS queries for the contoso.com domain. To make the records in the Azure DNS zone resolvable from the internet, you need to update the NS records at the DNS domain registrar to point to the name servers provided by Azure.

Answer 38

Everything below Management group in the hierarchy. Sub, RG & VM

Answer 39

B. The user principal name of each user only To perform a bulk delete of users in Azure Active Directory, you need to create and upload a CSV file that contains the list of users to be deleted. The file should include the user principal name (UPN) of each user only. Therefore, the answer is B. The user principal name of each user only. When you use the bulk delete feature in the Azure Active Directory admin center, you need to specify the UPN for each user that you want to delete. The UPN is a unique identifier for each user in Azure AD and is the primary way that Azure AD identifies and manages user accounts. Including additional attributes like the display name or usage location is not required for the bulk delete operation, as the UPN is the only mandatory attribute for the user account. However, you may include additional attributes in the CSV file if you want to keep track of the metadata associated with each user account.

Answer 40

B. Administrative units Administrative units in Azure AD allow you to organize and delegate administrative tasks to specific administrative units. You can assign specific permissions and roles to administrators based on these units. This approach allows local administrators to have control over users and resources within their respective offices without having full global permissions. It's a more granular and decentralized approach to user management. Azure AD roles (Option A) typically deal with assigning permissions at a broader level, and they might not provide the necessary granularity for managing users within specific offices. Access packages in Azure AD entitlement management (Option C) are used for granting access to resources and applications rather than delegating user management tasks. Azure roles (Option D) are primarily focused on managing permissions for Azure resources and services, not user management within Azure AD. So, the most suitable choice for delegating user management permissions to local administrators in different offices is "B. Administrative units."

Answer 41

B. Owner correct Owner = Grants full access to manage all resources, including the ability to assign roles in Azure RBAC. Contributor = Grants full access to manage all resources, but does NOT allow you to assign roles in Azure RBAC. (you cannot add users or changes their rights) User Access Administrator = Lets you manage user access to Azure resources. Reader = View all resources, but does not allow you to make any changes. Security Admin = View and update permissions for Security Center. Same permissions as the Security Reader role and can also update the security policy and dismiss alerts and recommendations. Network Contributor = Lets you manage networks, but not access to them. (so you can add VNET, subnet, etc)

Answer 42

A. Enable Active Directory Domain Service (AD DS) authentication for storage1. To grant the Group1 the Storage File Data SMB Share Elevated Contributor role for share1, you need to enable Active Directory Domain Service (AD DS) authentication for the storage account. By enabling AD DS authentication, you allow Azure AD security groups to be used for granting access control to file shares in the storage account. This enables you to assign roles, such as the Storage File Data SMB Share Elevated Contributor role, to the security group Group1 for the specific file share share1. Once AD DS authentication is enabled and the security group is assigned the appropriate role, Group1 will have the necessary permissions to access and manage the file share. Therefore, enabling Active Directory Domain Service (AD DS) authentication for storage1 is the first step you should take to grant Group1 the Storage File Data SMB Share Elevated Contributor role for share1.

Answer 43

B. Assign Group1 the User Access Administrator role for the root management group. The User Access Administrator role enables the user to grant other users access to Azure resources. This switch can be helpful to regain access to a subscription. Management groups give you enterprise-grade management at scale no matter what type of subscriptions you might have. Each directory is given a single top-level management group called the "Root" management group. This root management group is built into the hierarchy to have all management groups and subscriptions fold up to it. This root management group allows for global policies and Azure role assignments to be applied at the directory level. Incorrect: Not C: A few directories that started using management groups early in the preview before June 25 2018 could see an issue where not all the subscriptions were within the hierarchy. The process to have all subscriptions in the hierarchy was put in place after a role or policy assignment was done on the root management group in the directory.

Answer 44

A. Select the custom role and add Sub1 and Sub2 to the assignable scopes. Remove RG1 from the assignable scopes To assure the solution minimizes the administrative effort, we just need to change the assignable scope list of the custom role.

Answer 45

B. Event | search "error"

Answer 46

C. Assign the Website Contributor role to the developers. To allow the developers of App1 to use their Azure AD credentials to deploy content to App1 using Web Deploy, you should assign the Website Contributor role to the developers. This role provides the necessary permissions for developers to deploy content to the web app, but does not grant them excessive permissions that could be used to make unwanted changes. Option A is not recommended as it would grant excessive permissions to the developers, which could be used to make unwanted changes. Option B and D are not relevant to the scenario as the question is specifically asking for how to use Azure AD credentials for Web Deploy, not FTPS. Option C is a potential solution, but the Website Contributor role provides a more targeted and appropriate level of permissions for the scenario.

Answer 47

B. No The question states "You have a CSV file that contains the names and email addresses of 500 external users." This implies that the required fields (Email and Redirection URL)are missing from the .csv file. Here are the csv field pre-requisites that are needed for bulk upload of external users:

Answer 48

User1: C User 2: A

Answer 49

The correct answer is B. a service tag. In order to ensure that the virtual machines can access Vault1 while also using the principle of least privilege and minimizing administrative effort, you should configure a service tag as the destination of the outbound security rule for NSG1. Service tags represent a group of IP addresses associated with Azure PaaS and SaaS services. By specifying a service tag as the destination of the outbound security rule, you can allow the virtual machines to access Vault1 without having to manually specify the IP addresses of Vault1. This reduces administrative effort and ensures that the virtual machines are only able to access Vault1, rather than any other internet destination.

Answer 50

B. User1 and User4 only https://learn.microsoft.com/en-us/azure/active-directory/enterprise-users/licensing-group-advanced Under Limitations and known issues: "Group-based licensing currently does not support groups that contain other groups (nested groups). If you apply a license to a nested group, only the immediate first-level user members of the group have the licenses applied."

Answer 51

C. Assign User1 the Owner role for VNet1. There is only two choices for that puspose; - Assign User1 the Owner role for VNet1. - Assign User1 the User Access Administrator role for VNet1.

Answer 52

B. private endpoints Per the MS documentation, private endpoint seems to be the proper choice: "You can use private endpoints for your Azure Storage accounts to allow clients on a virtual network (VNet) to securely access data over a Private Link. The private endpoint uses a separate IP address from the VNet address space for each storage account service. Network traffic between the clients on the VNet and the storage account traverses over the VNet and a private link on the Microsoft backbone network, eliminating exposure from the public internet."

Answer 53

B. Assign User1 the Access Administrator role for VNet1

Answer 54

1. Yes - Reader access provides access to view all items exept secrets 2. Yes - both owner and user admin can assign owner 3. No - neither user access admin role or the reader role allows to create new resources

Answer 55

D. Configure Access control (IAM) for share1.

Answer 56

B. Assign User1 the User Access Administrator role for VNet1.

Answer 57

The `New-MgUser` cmdlet is part of the Microsoft Graph PowerShell module, and it's used for creating new users in Azure AD. However, when creating guest users (or B2B users), you typically would invite them rather than create them like regular members. The cmdlet you'd want to use for inviting external guest users is `New-AzureADMSInvitation` if you're using the AzureAD module or a related command in the Microsoft Graph module. Given the provided solution, the answer is: B. No

Answer 58

The New-MgInvitation cmdlet is part of the Microsoft Graph PowerShell module. It's used to create an invitation to an external user. When the invited user redeems their invitation, a guest user is created in the directory. If you use a PowerShell script that loops through each external user in the CSV file and runs the New-MgInvitation cmdlet for each of them, it will send out invitation emails to each of those external users. Once an external user accepts the invitation, they'll be added to the Azure AD tenant as a guest user. So, using the New-MgInvitation cmdlet in a PowerShell script for each external user does meet the goal of creating a guest user account in contoso.com for each of the 500 external users. The answer is: A. Yes

Answer 59

1. Azure AD and SAS 2. SAS only

Answer 60

C. Assign User1 the Owner role for VNet1

Answer 61

Correct Answer: D Azure Import/Export service supports the following of storage accounts: ✑ Standard General Purpose v2 storage accounts (recommended for most scenarios) ✑ Blob Storage accounts ✑ General Purpose v1 storage accounts (both Classic or Azure Resource Manager deployments), Azure Import/Export service supports the following storage types: ✑ Import supports Azure Blob storage and Azure File storage ✑ Export supports Azure Blob storage. Azure Files not supported. Only storage4 can be exported.

Answer 62

App1: Access control (IAM) Since the App1 uses Managed Identity, App1 can access the Storage Account via IAM. As per requirement, we need to minimize the number of secrets used, so Access keys is not ideal. App2: SAS We need temp access for App2, so we need to use SAS.

Answer 63

Kind: StorageV2 SKU: Standard_GRS

Answer 64

Correct Answer: B, C and E Step 1: Install the Azure File Sync agent on Server1. The Azure File Sync agent is a downloadable package that enables Windows Server to be synced with an Azure file share. Step 2: Register Server1. Register Windows Server with Storage Sync Service. Registering your Windows Server with a Storage Sync Service establishes a trust relationship between your server and the Storage Sync Service. Step 3: Create a sync group and a cloud endpoint. A sync group defines the sync topology for a set of files. Endpoints within a sync group are kept in sync with each other. A sync group must contain one cloud, which represents an Azure file share and one or more server endpoints. A server endpoint represents a path on registered server.

Answer 65

Step 1: Prepare the drives (Attach an external disk to Server1 and then run waimportexport.exe) Step 2: Create an import job (From the Azure portal, create an import job) Step 3: Ship the drives to the Azure datacenter (Detach the external disks from Server1 and ship the disks to an Azure data center) Step 4: Update the job with tracking information (From the Azure portal, update the import job)

Answer 66

Correct Answer: File1: Endpoint1 only It is a cloud endpoint, and it is scanned by the detection job every 24 hours. File2: Endpoint1, Endpoint2 and Endpoint3 With the on-premises servers the file is scanned and synced automatically after it's being added. Note: They changed the question in Exam from "within 24 hours" to "after 24 hours". So, the answer is: File1: Endpoint1, Endpoint2 and Endpoint3 File2: Endpoint1, Endpoint2 and Endpoint3

Answer 67

A. D. E. Step 1: Install the Azure File Sync agent on Server1 The Azure File Sync agent is a downloadable package that enables Windows Server to be synced with an Azure file share Step 2: Register Server1 Register Windows Server with Storage Sync Service Registering your Windows Server with a Storage Sync Service establishes a trust relationship between your server (or cluster) and the Storage Sync Service. Step 3: Add a server endpoint Create a sync group and a cloud endpoint. A sync group defines the sync topology for a set of files. Endpoints within a sync group are kept in sync with each other. A sync group must contain one cloud endpoint, which represents an Azure file share and one or more server endpoints. A server endpoint represents a path on registered server.

Answer 68

Replication: Zone-redundant storage (ZRS) Zone-redundant storage (ZRS) replicates your data synchronously across three storage clusters in a single Region. GRS protects against Zone failure, while ZRS protects against data center failure. LRS would not remain available if a data center in the region fails. GRS and RA GRS use asynchronous replication. Account type? StorageV2 (general purpose V2)

Answer 69

Correct Answer: B and E Modify the dataset.csv file in the root folder where the tool resides. Depending on whether you want to import a file or folder or both, add entries in the dataset.csv file Modify the driveset.csv file in the root folder where the tool is.

Answer 70

D. From the Recovery Service vault, stop the backup of each backup item.

Answer 71

Correct Answer: C Azure Import/Export service is used to securely import large amounts of data to Azure Blob storage and Azure Files by shipping disk drives to an Azure datacenter. This service can also be used to transfer data from Azure Blob storage to disk drives and ship to your on-premises sites. Data from one or more disk drives can be imported either to Azure Blob storage or Azure Files. The maximum size of an Azure Files Resource of a file share is 5 TB. Note: There are several versions of this question in the exam. The question has two correct answers: 1. Azure File Storage or 2. Azure Blob Storage The question can have other incorrect answer options, including the following: ✑ Azure Data Lake Store ✑ Azure SQL Database ✑ Azure Data Factory

Answer 72

B. blob and file only

Answer 73

A. Azure Files

Answer 74

D. two update domains

Answer 75

B. Azure Blob storage

Answer 76

Correct Answer: First action: Create a Storage Sync Service The deployment of Azure File Sync starts with placing a Storage Sync Service resource into a resource group of your selected subscription. Second action: Install the Azure File Sync agent The Azure File Sync agent is a downloadable package that enables Windows Server to be synced with an Azure file share. 1. Prepare Windows Server to use with Azure File Sync 2. Deploy the Storage Sync Service 3. Install the Azure File Sync agent 4. Register Windows Server with Storage Sync Service 5. Create a sync group and a cloud endpoint 6. Create a server endpoint 7. Configure firewall and virtual network settings