test 10 Flashcards

Question

We have reached the CPU quota in the West US 2 region. What two options do we have to move forward when creating this virtual machine? Delete other running VMs. Give the user admin rights. Click Ok to charge the subscription. Request a quota increase.

Answer 1

Delete other running VMs. Request a quota increase.

Answer 2

1) Shut down the machine. 2) Increase the plan size to DS3_v2. 3) Go into the networking blade of the VM 4) Click Attach Network Interface. 5) Select the existing NIC, and then click okay. 6) Start the machine.

Answer 3

Security Rule Subnets NIC

Answer 4

Node virtual machines

Answer 5

redirection to a provider endpoint

Answer 6

Users page, within the MFA Settings site.

Answer 7

SAS service.

Answer 8

No, you can only add a VM to an availability set when creating the VM.

Answer 9

Is scheduled on a multiple host machines.

Answer 10

D. Select the VM you are trying to attach the existing disk. Click Attach existing to attach the available disk to the VM. From the existing disk pane, select your disk, and then click OK

Answer 11

Owner User Access Administrator

Answer 12

Let me analyze each question: "When the maximum amount in Budget1 is reached, answer choice Answer: VM1 and VM2 continue to run Reason: Azure budgets are monitoring tools that can trigger alerts but do not automatically take action on resources While there are action groups configured (AG1, AG2, AG3), they only send notifications (email, SMS, Azure App) The budget is scoped to RG1, but this only affects monitoring, not resource control Therefore, reaching the budget limit will not automatically stop any VMs "Based on the current usage costs of the virtual machines, answer choice Answer: Two email notifications will be sent each month Reason: VM1 costs 20 euros/day in RG1 (the budget scope) Monthly cost for VM1 = 20 euros × 30 days = 600 euros Budget alerts are set at: 50% (500 euros) - Will trigger email via AG1 [1] 70% (700 euros) - Will trigger SMS via AG2 100% (1000 euros) - Will trigger Azure App via AG3 With VM1's monthly cost of 600 euros: The 50% threshold (500 euros) will be triggered The 70% threshold (700 euros) will not be triggered The 100% threshold (1000 euros) will not be triggered Note: VM2's costs (30 euros/day) are not considered since it's in RG2, which is outside the budget scope Two notifications will be sent: One to admin@contoso.com (via AG1) One to User1@Contoso.com (default budget recipient) Therefore, two email notifications will be sent each month when the 50% threshold is crossed.

Answer 13

The answer is No To meet the requirement, you should: Create a Custom Policy Definition that: Targets the Microsoft.Network/networkSecurityGroups resource type Uses the deployIfNotExists or modify effect Includes a policy rule that adds the required NSG rule for port 8080 Here's an example policy definition: { "mode": "All", "policyRule": { "if": { "field": "type", "equals": "Microsoft.Network/networkSecurityGroups" }, "then": { "effect": "modify", "details": { "roleDefinitionIds": [ "/providers/Microsoft.Authorization/roleDefinitions/4d97b98b-1d4f-4787-a291-c67834d212e7" ], "operations": [{ "operation": "add", "field": "properties.securityRules", "value": { "name": "Block8080", "properties": { "protocol": "TCP", "sourcePortRange": "*", "destinationPortRange": "8080", "sourceAddressPrefix": "VirtualNetwork", "destinationAddressPrefix": "VirtualNetwork", "access": "Deny", "priority": 100, "direction": "Inbound" } } }] } } } } Copy Insert at cursor json Steps to implement the solution: Create the custom policy definition using the above JSON Assign the policy to the subscription Set the policy assignment to use the "modify" effect Ensure the policy has the necessary permissions through role assignment This solution will: Automatically add the required rule to any new NSG created in the subscription Block TCP port 8080 between virtual networks Apply consistently across all resource groups in the subscription Work with the existing 10 virtual networks and any new ones created The custom policy approach is required because: It allows for specific rule configuration It can automatically modify resources upon creation It ensures consistent security rule implementation It works at scale across the subscription

Answer 14

Let me analyze each part of the question: "You can assign Policy1 to:" [1] Answer: Tenant Root Group, ManagementGroup1, Subscription1, and RG1 only Reason: Azure Policy assignments can be made at the following levels: Management Groups (including Tenant Root Group) Subscriptions Resource Groups Individual resources (like VM1) cannot be direct targets for policy assignments [2] The hierarchy allows for assignment at any level except individual resources Therefore, you can assign to all levels except VM1 You can exclude Policy1 from: ManagementGroup1, Subscription1, RG1, and VM1 only Exclusions can be specified for any resource or resource group within the scope of the policy assignment. However, you cannot exclude the Tenant Root Group itself because it is the top-level scope12. So, the correct options are: You can assign Policy1 to: Tenant Root Group, ManagementGroup1, Subscription1, RG1, and VM1 You can exclude Policy1 from: ManagementGroup1, Subscription1, RG1, and VM1 only

Answer 15

Let's analyze each statement based on the given information: RG1 has the Tag2:IT tag assigned only. RG1 is assigned the tag Tag2:IT. The policy to append Tag4:value4 does not apply to RG1 because VNET1 (which is in RG1) is excluded from the policy. Therefore, RG1 has the Tag2:IT Answer: Yes Storage1 has the Tag1:subscription, Tag2:IT, Tag3:value1, and Tag4:value4 tags assigned. Storage1 is assigned the tag Tag3:value1. The policy to append Tag4:value4 applies to Storage1 because it is within the scope of Sub1 and not excluded. However, Storage1 does not have Tag1:subscription or Tag2:IT assigned. Answer: No VNET1 has the Tag2:IT and Tag3:value2 tags assigned only. VNET1 is assigned the tag Tag3:value2. The policy to append Tag4:value4 does not apply to VNET1 because it is explicitly excluded. VNET1 does not have Tag2:IT assigned. Answer: No So, the correct answers are: RG1 has the Tag2:IT tag assigned only: Yes Storage1 has the Tag1:subscription, Tag2:IT, Tag3:value1, and Tag4:value4 tags assigned: No VNET1 has the Tag2:IT and Tag3:value2 tags assigned only: No

Answer 16

I'll help you with each statement. Statement 1: Policy1 can be applied to Subnet3. Correct answer: Yes Why: Policy1 is created in the South Central US Azure region, which is the same region as VNet3 (where Subnet3 is located). Service endpoint policies can be applied to subnets in the same region. Statement 2: Only storage1 and storage2 can be accessed from VNet2. Correct answer: No Why: VNet2 has a service endpoint for Microsoft.Storage, which allows access to all storage accounts in the subscription, not just storage1 and storage2. There is no restriction mentioned that would prevent access to storage3 from VNet2. Statement 3: Only storage2 can be accessed from VNet3. Correct answer: Yes Why: Similar to Statement 2, VNet3 has a service endpoint for Microsoft.Storage, which allows access to all storage accounts in the subscription, due to location match, So the statement is correct.

Answer 17

To configure a point-to-site (P2S) connection from an on-premises computer to VNet1, you need to perform the following actions: Create a route-based virtual network gateway (C): Point-to-site VPN connections require a route-based VPN gateway, not a policy-based one. This is because route-based gateways support IKEv2 and OpenVPN protocols, which are necessary for P2S connections. Delete GW1 (E): Since you currently have a policy-based virtual network gateway (GW1), you need to delete it before you can create a new route-based virtual network gateway. Azure does not allow changing the type of an existing gateway; you must delete the existing one and create a new one. Why the other options are incorrect: A. Add a service endpoint to VNet1: Service endpoints are used to secure Azure service resources to your virtual network, but they are not related to configuring VPN connections. B. Reset GW1: Resetting the gateway does not change its type from policy-based to route-based, which is necessary for P2S connections. D. Add a connection to GW1: Adding a connection to the existing policy-based gateway will not help because P2S connections require a route-based gateway. F. Add a public IP address space to VNet1: While a public IP address is necessary for the VPN gateway, this option is not relevant to the specific requirement of changing the gateway type to support P2S connections.

Answer 18

The answer is A. Yes Here's why this solution meets the goal: Azure Policy capabilities: Azure Policies allow you to enforce rules and compliance across your Azure resources They can be used to automatically enforce standards when new resources are created Policies can be applied at subscription level, which affects all resource groups within that subscription Custom Policy for NSGs: A custom policy definition can be created to define rules for NSG creation The policy can specify that any new NSG must include a security rule blocking TCP port 8080 When assigned at the subscription level, it will apply to all resource groups in that subscription Policy enforcement: The policy will automatically enforce the rule when new NSGs are created It ensures consistency across all NSGs in the subscription It prevents creation of NSGs that don't comply with the port 8080 blocking requirement Benefits of this approach: Centralized control: Manages security rules across multiple virtual networks from one policy Automated enforcement: No need for manual intervention when new NSGs are created Consistent security: Ensures uniform security rules across all virtual networks Scalable: Automatically applies to new NSGs as they are created This solution is particularly effective because: It's preventive rather than reactive It ensures compliance by default It reduces administrative overhead It eliminates the risk of human error in implementing the security rule

Answer 19

The correct answer is A: Remove Microsoft.Compute/virtualMachines from the policy.

Answer 20

To determine the maximum number of additional policies you can create for cont2, we need to analyze two aspects: stored access policies and immutable blob storage policies. Stored Access Policies Azure Storage accounts have a limit on the number of stored access policies you can create per container. The limit is five stored access policies per container. In the case study, cont2 already has three stored access policies created: Stored1, Stored2, and Stored3. Therefore, the number of additional stored access policies you can create is: Max Policies ( 5 ) − Existing Policies ( 3 ) = 2 Max Policies(5)−Existing Policies(3)=2 Immutable Blob Storage Policies Azure Storage accounts allow the use of immutable blob storage policies to enforce legal holds and time-based retention policies. A container can have: One legal hold policy (already applied in this case). Multiple time-based retention policies, but the total combined limit of immutable blob storage policies is two per container. Since cont2 already has one immutable blob storage policy (the legal hold), you can create one additional immutable blob storage policy. Correct Answer Stored access policies: 2 Immutable blob storage policies: 1 Explanation Stored Access Policies: The total allowed is five, and three are already in place, leaving space for two more. Immutable Blob Storage Policies: A container can have a maximum of two, and one is already in place (the legal hold), leaving space for one additional policy.

Answer 21

The correct answer is D: cont1, share1, and share2. Here's why: Based on the storage account details provided: storage1 has both cont1 (container) and share1 (file share) storage2 has both cont2 (container) and share2 (file share) The planned changes state: "Whenever possible, use directories to organize storage account content." Both containers and file shares can be used to organize storage content: Azure Storage containers can organize blob storage using virtual directory hierarchy Azure Files shares support proper directory structures All three existing storage components (cont1, share1, and share2) can be used because: Containers (cont1) support blob storage organization through virtual directories File shares (share1 and share2) natively support directory structures Both storage accounts (storage1 and storage2) are StorageV2, which supports modern storage features