Test 1

Question 1

Azure Admin1 and Admin2 are global administrators of Tenant1. Azure Admin1 is a ServiceAdministrator of Subscription1. Can Admin2 add a new administrator to Subscription1?

Answer 1

No, by default Global Administrators do not have managerial access to Azure subscription unless explicitly defined. Hence Admin2 cannot do anything in the subscription. Cannot even see it in the list of subscriptions.

Question 2

Which types of storage support the archive tier?

Answer 2

BlobStorage and StorageV2.

Question 3

Which types of storage do not support the archive tier?

Answer 3

FileStorage and Storage.

Question 4

Does the “storage” type support archive tier storage?

Answer 4

No, only BlobStorage and StorageV2 support archive-tier storage.

Question 5

AdminUser1 is a global administrator of Tenant1, but cannot see all the resources inside the tenant. What could they do to view all resources, and how?

Answer 5

AdminUser1 could elevate their access to manage all subscriptions and management groups. To do, this they can go to “Azure Active Directory” in the Azure Portal, then Properties, and then select “Elevate Access”.

Question 6

What is virtual network peering in Azure?

Answer 6

Virtual network peering is connecting two or more networks.

Question 7

Name and define the two types of virtual network peering.

Answer 7

Virtual network peering - connecting two or more networks within the same region.

Global virtual network peering - connecting two or more networks across Azure regions.

Question 8

What can prevent peering two networks?

Answer 8

Networks with overlapping address spaces cannot be peered.

Question 9

Which type of gateway can be connected to a point-to-site connection?

Answer 9

A route-based virtual network gateway.

Question 10

Can a route-based virtual network gateway be used to create a point-to-site connection?

Answer 10

Yes, route-based virtual network gateways can be used to create a P2S connection.

Question 11

Can a policy-based virtual network gateway be used to create a point-to-site connection?

Answer 11

No, only a route-based virtual network gateway can be used to create a P2S connection.

Question 12

What is a service endpoint in Azure and what are they used for?

Answer 12

Service endpoints are direct, network connections to Azure services. They allow private connections directly to Azure services without requiring a public IP address.

Question 13

You have an Azure virtual machine named VM1 that connects to a virtual network named VNet1.

VM1 has the following configuration:
Subnet: 10.0.0.0/24
Availability set: AVSet
Network security group (NSG): None
Private IP address: 10.0.0.4 (dynamic)
Public IP address: 40.90.219.6 (dynamic)

What must you do to deploy a standard load balancer and allow it to connect to VM1?

Answer 13

You must remove the dynamic public IP address assigned to VM1 and change it to a static public IP address.

Question 14

Can two machines in the same VNET communicate if there is no NSG configured?

Answer 14

Yes, by default machines within the same VNET can communicate freely with each other.

Question 15

Can two machines in different VNETs communicate without an NSG configured?

Answer 15

No, machines cannot communicate freely with other networks by default.

Question 16

VNET 1 has 2 subnets, and VNET 2 has 3 subnets. Can machines in VNET1Sub1 communicate with VNET1Sub2 by default?

Answer 16

Yes, by default machines within the same VNET can communicate freely with each other, even between subnets.

Question 17

VNET 1 has 2 subnets, and VNET 2 has 3 subnets. Can machines in VNET1Sub1 communicate with VNET2Sub3 by default?

Answer 17

No, machines cannot communicate freely with other networks by default.

Question 18

VNET 1 has 2 subnets, and VNET 2 has 3 subnets. Can machines in VNET2Sub2 communicate with VNET2Sub3 by default?

Answer 18

Yes, by default machines within the same VNET can communicate freely with each other, even between subnets.

Question 19

VNET 1 is located in East US, and public IP IP1 is located in West Europe. In which regions can you create a network interface card (NIC)?

Answer 19

East US only - a NIC can only be created in a location which has a VNET.

Question 20

What is Azure Network Watcher?

Answer 20

Azure Network Watcher provides network performance monitoring and diagnostics tools.

Question 21

What is Azure Monitor?

Answer 21

Azure Monitor collects logs and metrics from your applications and infrastructure for monitoring. It does not contain any “active” investigation methods like packet captures.

Question 22

What is the difference between Azure Network Monitor and Azure Watcher?

Answer 22

Azure Network Watcher provides “active” investigation tools like packet captures and IP flow verification, whereas Azure Monitor provides only collection, analytics monitoring and reporting tools.

Question 23

In Azure Network Watcher, what is the IP flow verify tool?

Answer 23

The IP flow verify tool checks if a packet is allowed or denied to or from a specified virtual machine. The security group decision and the name of the rule that denied the packet are returned.

Question 24

In Azure Network Watcher, what is the next hop tool?

Answer 24

Next hop provides the next hop from a source machine to a target destination.

Question 25

How could you identify a security rule that prevents a network packet from reaching an Azure virtual machine?

Answer 25

Use the IP flow verify tool within Azure Network Watcher.

Question 26

In Azure Network Watcher, what is the connection troubleshoot tool?

Answer 26

Connection troubleshoot provides the ability to test a direct connection from a virtual machine to another VM, IP, FQDN or URL.

Question 27

Which protocols does the connection troubleshoot tool support?

Answer 27

TCP and ICMP.

Question 28

What is the difference between the IP flow verify and connection troubleshoot tools?

Answer 28

Connection troubleshoot can be used to test a connection between a VM and any IP, FQDN or URL using TCP and ICMP. IP flow verify checks is a packet is allowed to or from a virtual machine and returns the impacting security group decision and rule. IP flow verify supports UDP, whereas connection troubleshoot does not.