test14 Flashcards
DRAG DROP -
You have an Azure subscription that contains two on-premises locations named site1 and site2.
You need to connect site1 and site2 by using an Azure Virtual WAN.
Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct
order.
Select and Place:
Actions
Create a virtual hub.
Create VPN sites.
Connect the virtual networks to the hub.
Create a Virtual WAN resource.
Connect the VPN sites to the hub.
Answer Area
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You deploy an Azure Kubernetes Service (AKS) cluster named AKS1.
You need to deploy a YAML file to AKS1.
Solution: From Azure Cloud Shell, you run az aks.
Does this meet the goal?
A. Yes
B. No
HOTSPOT -
You have the following custom role-based access control (RBAC) role.
```json
{
“id”: “b988327b-7dae-4d00-8925-1cc14fd68be4”,
“properties”: {
“roleName”: “Rolel”,
“description”: “”,
“assignableScopes”: [
“/subscriptions/c691ad84-99f2-42fd-949b-58afd7ef6ab3”
],
“permissions”: [
{
“actions”: [
“Microsoft.Resources/subscription/resourceGroups/resources/read”,
“Microsoft.Resources/subscription/resourceGroups/read”,
“Microsoft.Resourcehealth/”,
“Microsoft.Authorization//read”,
“Microsoft.Compute//read”,
“Microsoft.Support/”,
“Microsoft.Authorization//read”,
“Microsoft.Network/virtualNetworks/read”,
“Microsoft.Resources/deployments/”,
“Microsoft.Resources/subscription/resourceGroups/read”,
“Microsoft.Storage/storageAccounts/read”,
“Microsoft.Compute/virtualMachines/start/action”,
“Microsoft.Compute/virtualMachines/powerOff/action”,
“Microsoft.Compute/virtualMachines/deallocate/action”,
“Microsoft.Compute/virtualMachines/restart/action”,
“Microsoft.Compute/virtualMachines/”,
“Microsoft.Compute/disks/”,
“Microsoft.Compute/availabilitySets/”,
“Microsoft.Network/virtualNetworks/subnets/join/action”,
“Microsoft.Network/virtualNetworks/subnets/read”,
“Microsoft.Network/virtualNetworks/subnets/virtualMachines/read”,
“Microsoft.Network/networkInterfaces/”,
“Microsoft.Compute/snapshots/”
],
“notActions”: [
“Microsoft.Authorization//Delete”,
“Microsoft.Authorization/*/Write”,
“Microsoft.Authorization/elevateAccess/Action”
]
}
]
}
}
~~~
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
Statements
Users that are assigned Role1 can assign Role1 to users.
Users that are assigned Role1 can deploy new virtual machines.
Users that are assigned Role1 can set a static IP address on a virtual machine.
Answer Area
HOTSPOT -
You configure the custom role shown in the following exhibit.
```json
{
“properties”: {
“roleName”: “rolel”,
“description”: “”,
“roletype”: “true”,
“assignableScopes”: [
“/subscriptions/3d6209d5-c714-4440-9556e-d6342086c2d7/”
],
“permissions”: [
{
“actions”: [
“Microsoft.Authorization//read”,
“Microsoft.Compute/availabilitySets/”,
“Microsoft.Compute/locations/”,
“Microsoft.Compute/virtualMachines/”,
“Microsoft.Compute/virtualMachineScaleSets/”,
“Microsoft.Compute/disks/write”,
“Microsoft.Compute/disks/read”,
“Microsoft.Compute/disks/delete”,
“Microsoft.Network/locations/”,
“Microsoft.Network/networkInterfaces/”,
“Microsoft.Network/networkSecurityGroups/join/action”,
“Microsoft.Network/networkSecurityGroups/read”,
“Microsoft.Network/publicIPAddresses/join/action”,
“Microsoft.Network/publicIPAddresses/read”,
“Microsoft.Network/virtualNetworks/read”,
“Microsoft.Network/virtualNetworks/subnets/join/action”,
“Microsoft.Resources/deployments/”,
“Microsoft.Resources/subscriptions/resourceGroups/read”,
“Microsoft.Support/*”
],
“notActions”: [],
“dataActions”: [],
“notDataActions”: []
}
]
}
}
~~~
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.
Hot Area:
To ensure that users can sign in to virtual machines that are
Answer Area
To ensure that users can sign in to virtual machines that are assigned role1, modify the [answer choice] section:
Dropdown options:
actions
roletype
notActions
dataActions
notDataActions
assignableScopes
To ensure that role1 can be assigned only to a resource group named RG1, modify the [answer choice] section:
Dropdown options:
actions
roletype
notActions
dataActions
notDataActions
assignableScopes
HOTSPOT:
You have an Azure subscription that contains the resources shown in the following table:
Name Type Description
VNET1 Virtual network Contains subnet1 and subnet2
subnet1 Subnet IP address space 10.3.0.0/24
subnet2 Subnet IP address space 10.4.0.0/24
NSG1 Network security group(NS) None
vm1 Virtual machine IP address 10.3.0.15
vm2 Virtual machine IP address 10.4.0.16
storage1 Storage account None
NSG1 is configured as shown in the following exhibit:
Inbound security rules:
Priority Name Port Protocol Source Destination Action
110 HTTPS_VM1_Deny 443 TCP Internet 10.3.0.15 Deny
65000 AllowVnetInBound Any Any VirtualNetwork VirtualNetwork Allow
65001 AllowAzureLoadBalancerInBound Any Any AzureLoadBalancer Any Allow
65500 DenyAllInBound Any Any Any Any Deny
Outbound security rules:
Priority Name Port Protocol Source Destination Action
145 Storage_Access 443 TCP VirtualNetwork Storage Allow
150 Block_Internet Any Any VirtualNetwork Internet Deny
65000 AllowVnetOutBound Any Any VirtualNetwork VirtualNetwork Allow
65001 AllowInternetOutBound Any Any Any Internet Allow
65500 DenyAllOutBound Any Any Any Any Deny
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
Answer Area
Statements Yes No
VM1 can access storage1. ( ) ( )
VM2 can access VM1 by using the HTTPS protocol. ( ) ( )
The security rules for NSG1 apply to any virtual machine on VNET1. ( ) ( )
You have an Azure subscription named Sub1 that contains the resources shown in the following table.
You create a user named Admin1.
To what can you add Admin1 as a co-administrator?
A. RG1
B. MG1
C. Sub1
D. VM1
Name | Type |
|—|—|
| MG1 | Management group |
| RG1 | Resource group |
| VM1 | Virtual machine |
You have a Microsoft 365 tenant and an Azure Active Directory (Azure AD) tenant named contoso.com.
You plan to grant three users named User1, User2, and User3 access to a temporary Microsoft SharePoint document library named Library1.
You need to create groups for the users. The solution must ensure that the groups are deleted automatically after 180 days.
Which two groups should you create? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
A. a Microsoft 365 group that uses the Assigned membership type
B. a Security group that uses the Assigned membership type
C. a Microsoft 365 group that uses the Dynamic User membership type
D. a Security group that uses the Dynamic User membership type
E. a Security group that uses the Dynamic Device membership type
HOTSPOT
You have an Azure Active Directory (Azure AD) tenant named contoso.onmicrosoft.com that contains the users shown in the following table:
Name Member of Role assigned
User1 Group1 None
User2 Group2 None
User3 Group1, Group2 User administrator
You enable password reset for contoso.onmicrosoft.com as shown in the Password Reset exhibit.
(Click the Password Reset tab.)
Self-service password reset enabled
None
Selected
All (Selected)
Select group
Group2
(Options displayed for groups)
Number of methods required to reset
1
2 (Selected)
Methods available to users
Mobile app notification
Mobile app code
Email
Mobile phone
Office phone
Security questions
Number of questions required to register
3
4
5 (Selected)
Number of questions required to reset
3 (Selected)
4
5
Select security questions
10 security questions selected.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
Answer Area
Statements Yes No
After User2 answers three security questions correctly, he can reset his password immediately. ( ) ( )
If User1 forgets her password, she can reset the password by using the mobile phone app. ( ) ( )
User3 can add security questions to the password reset process. ( ) ( )
You have an Azure subscription that has the Azure container registries shown in the following table.
| Name | Service tier |
|—|—|
| ContReg1 | Premium |
| ContReg2 | Standard |
| ContReg3 | Basic |
You plan to use ACR Tasks and configure private endpoint connections.
Which container registries support ACR Tasks and private endpoints? To answer, select the appropriate options in the answer area
NOTE: Each correct selection is worth one point.
Answer Area
ACR Tasks:
ContReg1 only
ContReg1 and ContReg2 only
ContReg1, ContReg2, and ContReg3
Private endpoints:
ContReg1 only
ContReg1 and ContReg2 only
ContReg1, ContReg2, and ContReg3
You have an Azure subscription named Subscription1 that has the following providers registered:
✑ Authorization
✑ Automation
✑ Resources
✑ Compute
✑ KeyVault
✑ Network
✑ Storage
✑ Billing
✑ Web
Subscription1 contains an Azure virtual machine named VM1 that has the following configurations:
✑ Private IP address: 10.0.0.4 (dynamic)
✑ Network security group (NSG): NSG1
✑ Public IP address: None
✑ Availability set: AVSet
✑ Subnet: 10.0.0.0/24
✑ Managed disks: No
✑ Location: East US
You need to record all the successful and failed connection attempts to VM1.
Which three actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
A. Enable Azure Network Watcher in the East US Azure region.
B. Add an Azure Network Watcher connection monitor.
C. Register the MicrosoftLogAnalytics provider.
D. Create an Azure Storage account.
E. Register the Microsoft.Insights resource provider.
F. Enable Azure Network Watcher flow logs.
Your company has two on-premises servers named SRV01 and SRV02. Developers have created an application that runs on SRV01. The application calls a service on SRV02 by IP address.
You plan to migrate the application on Azure virtual machines (VMs). You have configured two VMs on a single subnet in an Azure virtual network.
You need to configure the two VMs with static internal IP addresses.
What should you do?
A. Run the New-AzureRMVMConfig PowerShell cmdlet.
B. Run the Set-AzureSubnet PowerShell cmdlet.
C. Modify the VM properties in the Azure Management Portal.
D. Modify the IP properties in Windows Network and Sharing Center.
E. Run the Set-AzureStaticVNetIP PowerShell cmdlet.
You have an Azure subscription that contains a storage account named storage1. The storage1 account contains a container named container1.
You need to configure access to container1. The solution must meet the following requirements:
* Only allow read access.
* Allow both HTTP and HTTPS protocols.
* Apply access permissions to all the content in the container.
What should you use?
A. an access policy
B. a shared access signature (SAS)
C. Azure Content Delivery Network (CDN)
D. access keys
DRAG DROP -
You have a Microsoft Entra tenant.
You need to ensure that when a new Microsoft 365 group is created, the group name is automatically formatted as follows:<Department><Group name>
Which three actions should you perform in sequence in the Microsoft Entra admin center? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Actions Answer Area
Set Add suffix to Attribute.
Create a group naming policy.
Set Add prefix to Attribute.
Set Add suffix to String.
Set Add prefix to String.
Set Select type to Department.
Customize the company branding.
DRAG DROP-
You have downloaded an Azure Resource Manager (ARM) template to deploy numerous virtual machines (VMs). The ARM template is based on a current VM, but must be
adapted to reference an administrative password.
You need to make sure that the password cannot be stored in plain text.
You are preparing to create the necessary components to achieve your goal.
Which of the following should you create to achieve your goal? Answer by dragging the correct option from the list to the answer area.
Select and Place:
Options
An Azure Key Vault
An Azure Storage account
Azure Active Directory (AD)
Identity Protection
An access policy
An Azure policy
A backup policy
Answer
Your company has a main office in London that contains 100 client computers.
Three years ago, you migrated to Azure Active Directory (Azure AD).
The company’s security policy states that all personal devices and corporate-owned devices must be registered or joined to Azure AD.
A remote user named User1 is unable to join a personal device to Azure AD from a home network.
You verify that User1 was able to join devices to Azure AD in the past.
You need to ensure that User1 can join the device to Azure AD.
What should you do?
A. Assign the User administrator role to User1.
B. From the Device settings blade, modify the Maximum number of devices per user setting.
C. Create a point-to-site VPN from the home network of User1 to Azure.
D. From the Device settings blade, modify the Users may join devices to Azure AD setting.
