test16 Flashcards
Your on-premises network contains an SMB share named Share1.
You have an Azure subscription that contains the following resources:
✑ A web app named webapp1
✑ A virtual network named VNET1
You need to ensure that webapp1 can connect to Share1.
What should you deploy?
A. an Azure Application Gateway
B. an Azure Active Directory (Azure AD) Application Proxy
C. an Azure Virtual Network Gateway
which option is correct? why correct?
C. an Azure Virtual Network Gateway
Why C is Correct:
SMB Share Connectivity:
SMB (Server Message Block) shares typically exist on-premises and require a secure network connection for access.
To enable your Azure resources (like the webapp1) to access on-premises resources (Share1), you need to set up a hybrid connectivity solution.
Azure Virtual Network Gateway:
An Azure Virtual Network Gateway enables secure communication between your Azure Virtual Network (VNET1) and your on-premises network via a VPN connection (Site-to-Site VPN or Point-to-Site VPN).
This ensures that webapp1, which is connected to VNET1, can route traffic to your on-premises SMB share (Share1).
Integration Path:
webapp1 → VNET1 → Virtual Network Gateway → On-premises network → SMB Share (Share1)
SMB Protocol Compatibility:
SMB relies on private IP connectivity, which requires a secure tunnel or VPN connection.
Azure Virtual Network Gateway provides this tunnel, enabling communication between Azure and your on-premises network.
Why the Other Options are Incorrect:
A. Azure Application Gateway
Purpose: Azure Application Gateway is a Layer 7 load balancer for HTTP/HTTPS traffic.
Why Incorrect: SMB operates at a lower level (Layer 4 - transport layer, using TCP port 445), not HTTP/HTTPS. It is not designed for accessing SMB shares.
B. Azure Active Directory (Azure AD) Application Proxy
Purpose: Azure AD Application Proxy is used to publish web applications (e.g., HTTP/HTTPS) that are hosted on-premises.
Why Incorrect: SMB shares are file shares, not web applications. Azure AD Application Proxy does not support SMB protocol or file-based resources.
You create a Recovery Services vault backup policy named Policy1 as shown in the following exhibit:
Policy name *
Policy1
Backup schedule
Frequency * Time * Timezone *
Daily 11:00 PM (UTC) Coordinated Universal Time
Instant Restore
Retain instant recovery snapshot(s) for
2 Day(s)
Retention range
Retention of daily backup point.
At For Day(s)
11:00 PM 30
Retention of weekly backup point.
On * At For Week(s)
Sunday 11:00 PM 10
Retention of monthly backup point.
Week Based Day Based
On * At For Month(s)
1 11:00 PM 36
Retention of yearly backup point.
Week Based Day Based
In * On * At For Year(s)
March 1 11:00 PM 10
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.
Answer Area
The backup that occurs on Sunday, March 1, will be retained for [answer choice].
30 days
10 weeks
36 months
10 years
The backup that occurs on Sunday, November 1, will be retained for [answer choice].
30 days
10 weeks
36 months
10 years
Which one is correct in per question on answer area? why?
Analyzing the Policy1 Configuration
Daily Backup:
Time: 11:00 PM UTC
Retention: 30 Days
Weekly Backup:
Day: Sunday
Time: 11:00 PM UTC
Retention: 10 Weeks
Monthly Backup:
Day of Month: 1
Time: 11:00 PM UTC
Retention: 36 Months
Yearly Backup:
Month: March
Day of Month: 1
Time: 11:00 PM UTC
Retention: 10 Years
Determining Retention Periods
Backup on Sunday, March 1:
Analysis: This backup meets all conditions: it’s a daily backup, it’s a Sunday so it’s also a weekly backup, it’s the 1st day of the month, and it’s March 1st so it’s also a yearly backup. The longest matching retention period of 10 years will be applied, so the backup will be kept for 10 years.
Answer: 10 years
Backup on Sunday, November 1:
Analysis: This backup meets the daily and weekly conditions, but not the monthly or yearly conditions. Therefore, the retention period from the weekly policy will be applied, meaning the backup will be retained for 10 weeks.
Answer: 10 weeks
Answer Area:
The backup that occurs on Sunday, March 1, will be retained for: 10 years
The backup that occurs on Sunday, November 1, will be retained for: 10 weeks
You have an Azure subscription.
You are deploying an Azure Kubernetes Service (AKS) cluster that will contain multiple pods. The pods will use kubernet networking.
You need to restrict network traffic between the pods.
What should you configure on the AKS cluster?
A. the Azure network policy
B. the Calico network policy
C. pod security policies
D. an application security group
I think the correct answer is B.
The question describes “the pods will use kubernet networking.”
To provide network connectivity, AKS clusters can use kubenet (basic networking) or Azure CNI (advanced networking).
Azure Network Policies supports Azure CNI only. Calico Network Policies supports both Azure CNI (Windows Server 2019 and Linux) and kubenet (Linux).
Hence, the correct answer is B.
You have an Azure subscription that contains an Azure App Service web app named App1 and an Azure key vault named KV1. KV1 contains a wildcard certificate for contoso.com.
You have a user named user1@contoso.com that is assigned the Owner role for App1 and KV1.
You need to configure App1 to use the wildcard certificate of KV1.
What should you do first?
A. Create an access policy for KV1 and assign the Microsoft Azure App Service principal to the policy.
B. Assign a managed user identity to App1.
C. Configure KV1 to use the role-based access control (RBAC) authorization system.
D. Create an access policy for KV1 and assign the policy to User1.
which one is correct? why correct?
The correct answer is B. Assign a managed user identity to App1.
Explanation:
To configure App1 to use the wildcard certificate stored in KV1, you need to ensure that App1 has the necessary permissions to access KV1. The best practice for this scenario is to use a managed identity for App1. Managed identities provide an automatically managed identity in Azure AD for applications to use when connecting to resources that support Azure AD authentication, such as Azure Key Vault.
Once you assign a managed identity to App1, you can then create an access policy in KV1 to grant the managed identity the necessary permissions to access the certificate. This approach is more secure and manageable compared to assigning permissions directly to a user.
Steps:
Assign a managed user identity to App1.
Create an access policy for KV1 and assign the managed identity of App1 to the policy with the necessary permissions (e.g., get, list).
This ensures that App1 can securely access the wildcard certificate in KV1.
Your company’s Azure subscription includes Azure virtual machines (VMs) that run Windows Server 2016.
One of the VMs is backed up every day using Azure Backup Instant Restore.
When the VM becomes infected with data encrypting ransomware, you decide to recover the VM’s files.
Which of the following is TRUE in this scenario?
A. You can only recover the files to the infected VM.
B. You can recover the files to any VM within the company’s subscription.
C. You can only recover the files to a new VM.
D. You will not be able to recover the files.
which one is correct? why correct?
Analyzing the Situation
Azure VMs: The company uses Azure VMs running Windows Server 2016.
Daily Backups: One VM is backed up daily with Azure Backup Instant Restore.
Ransomware Infection: The VM is infected, and file recovery is needed.
Determining the Correct Statement
Let’s evaluate each option:
A. You can only recover the files to the infected VM.
Analysis: This is incorrect. While you can recover files to the original VM, you can also restore to an alternative virtual machine.
B. You can recover the files to any VM within the company’s subscription.
Analysis: This is the correct statement. You can recover files to a different Azure virtual machine (as long as it is in the same region), as the process mounts the disk to the target VM.
C. You can only recover the files to a new VM.
Analysis: This option is incorrect, as you can restore to the existing virtual machine as well as a new virtual machine.
D. You will not be able to recover the files.
Analysis: The backup has been performed and there is no indication that the backup has been corrupted, therefore the files can be recovered. This option is incorrect.
The Correct Statement
The correct statement is: You can recover the files to any VM within the company’s subscription.
Answer:
B. You can recover the files to any VM within the company’s subscription.
You have an Azure subscription.
You plan to migrate 50 virtual machines from VMware vSphere to the subscription.
You create a Recovery Services vault.
What should you do next?
A. Configure an extended network.
B. Create a recovery plan.
C. Deploy an Open Virtualization Application (OVA) template to vSphere.
D. Configure a virtual network.
which one is correct? why correct?
Understanding Azure Site Recovery for VMware
Azure Site Recovery (ASR): An Azure service used for disaster recovery and migration of virtual machines, including VMware vSphere VMs to Azure.
Recovery Services Vault: A container for managing ASR operations.
Configuration Server: A virtual machine (VM) that is deployed on vSphere that configures the environment, performs replication, and allows communication to the Recovery Services vault. The configuration server is deployed using the Open Virtualization Application (OVA) template.
Extended network: A network that extends from on-premises to Azure, which is not the correct term.
Recovery Plan: An orchestration plan for failover/failback, usually created after the resources are set up and protected.
Virtual Network: A basic requirement for Azure resources, but it will be created as part of the replication process.
Analyzing the Requirements
Migration from vSphere: We need to migrate 50 VMware VMs to Azure.
Recovery Services Vault Created: A vault already exists, and is the central point of management for the migration.
Determining the Correct Next Step
Let’s evaluate the options:
A. Configure an extended network.
Analysis: This is incorrect. An extended network is not a term that is used in the Azure environment. This does not represent a required configuration.
B. Create a recovery plan.
Analysis: While a recovery plan will be needed for the final failover step, it is not required before configuring the migration. Therefore, this is not the next step.
C. Deploy an Open Virtualization Application (OVA) template to vSphere.
Analysis: This is the correct next step. Before virtual machines can be replicated to Azure, a configuration server must be deployed on the on-premises vSphere environment. This configuration server provides the connection to the Azure environment, and enables replication of the virtual machines. The configuration server is deployed using the provided OVA template.
D. Configure a virtual network.
Analysis: While a virtual network will be needed, this is created as part of the replication configuration, so is not the next action to perform. This action is not correct.
The Correct Next Step
The correct next step is to Deploy an Open Virtualization Application (OVA) template to vSphere.
Answer:
C. Deploy an Open Virtualization Application (OVA) template to vSphere.
You plan to create an Azure virtual machine named VM1 that will be configured as shown in the following exhibit.
Create a virtual machine
PROJECT DETAILS
Subscription: MyDev-Test Subscription
Resource group: RG1
(Create new)
INSTANCE DETAILS
Virtual machine name: VM1
Region: (US) West US 2
Availability options: No infrastructure redundancy required
Image: Windows Server 2016 Datacenter
(Browse all public and private images)
Azure Spot instance: No
Size: Standard DS1 v2
1 vCPU, 3.5 GiB memory (ZAR 632.47/month)
(Change size)
Tabs on top:
Basics | Disks | Networking | Management | Advanced | Tags | Review + create
Top notification
“⚠ Changing Basic options may reset selections you have made. Review all options prior to creating the virtual machine.”
The planned disk configurations for VM1 are shown in the following exhibit.
Disks
Description:
“Azure VMs have one operating system disk and a temporary disk for short-term storage. You can attach additional data disks. The size of the VM determines the type of storage you can use and the number of data disks allowed. Learn more”
Disk options
OS disk type: Standard HDD
(The selected VM size supports premium disks. We recommend Premium SSD for high IOPS workloads. Virtual machines with Premium SSD disks qualify for the 99.9% connectivity SLA.)
Enable Ultra Disk compatibility (Preview):
Yes
No (selected)
(Ultra Disks are only available when using Managed Disks.)
Data disks
“You can add and configure additional data disks for your virtual machine or attach existing disks. This VM also comes with a temporary disk.”
(Note: Adding unmanaged data disks is currently not supported at the time of VM creation. You can add them after the VM is created.)
Advanced
Use managed disks:
No (selected)
Yes
Storage account:
(new) rg1 disks799
(Create new)
Tabs on top:
Basics | Disks | Networking | Management | Advanced | Tags | Review + create
You need to ensure that VM1 can be created in an Availability Zone.
Which two settings should you modify? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
A. Use managed disks
B. OS disk type
C. Availability options
D. Size
E. Image
which option is correct? why correct?
The correct answers are A and C:
A. Use managed disks
C. Availability options
Here’s why these are the correct answers:
Use managed disks (A):
Availability Zones require managed disks
The current configuration shows “Use managed disks: No”
Unmanaged disks are not supported in Availability Zones
You must change this to “Yes” to enable Availability Zone support [1]
Availability options (C):
Current setting shows “No infrastructure redundancy required”
To use Availability Zones, you need to change this setting to specify an Availability Zone [2]
This setting must be modified to select a specific Availability Zone for the VM
Why the other options are incorrect:
B. OS disk type:
While Premium SSD is recommended for better performance, the disk type itself doesn’t affect Availability Zone compatibility
Standard HDD can work with Availability Zones as long as it’s managed
D. Size:
The current size (Standard DS1 v2) supports Availability Zones
VM size doesn’t determine Availability Zone compatibility
E. Image:
Windows Server 2016 Datacenter is supported in Availability Zones
The image selection doesn’t affect Availability Zone compatibility
Key requirements for Availability Zones:
Must use managed disks [3]
Must explicitly select an Availability Zone in the availability options
Must be in a region that supports Availability Zones
Therefore, to enable VM1 to be created in an Availability Zone, you need to:
Change “Use managed disks” from No to Yes
Modify “Availability options” to select a specific Availability Zone
You have the Azure virtual machines shown in the following table:
You have a Recovery Services vault that protects VM1 and VM2.
You need to protect VM3 and VM4 by using Recovery Services.
What should you do first?
Name Azure region
VM1 West Europe
VM2 West Europe
VM3 North Europe
VM4 North Europe
A. Create a new Recovery Services vault
B. Create a storage account
C. Configure the extensions for VM3 and VM4
D. Create a new backup policy
which option is correct? why correct?
The correct answer is A: Create a new Recovery Services vault.
Here’s why:
Recovery Services Vault Regional Limitations:
Recovery Services vaults are region-specific
A single vault can only protect resources within the same region
VM1 and VM2 are in West Europe and are protected by an existing vault
VM3 and VM4 are in North Europe (different region)
Why a new vault is needed:
You cannot use the existing vault in West Europe to protect VMs in North Europe
Each region requires its own Recovery Services vault
This is a fundamental architectural requirement for Azure Backup
Why other options are incorrect:
B. Create a storage account
Storage accounts are not a prerequisite for Azure Backup [1]
The Recovery Services vault manages the backup storage automatically [2]
This is not the first step in protecting new VMs
C. Configure the extensions for VM3 and VM4
Extensions can’t be configured without a vault in place
This is a subsequent step after creating the vault
The backup extension is automatically managed by Azure Backup
D. Create a new backup policy
Backup policies are created within a Recovery Services vault [3]
You can’t create a policy without first having a vault
This would be a later step in the process
The correct sequence of steps would be:
Create a new Recovery Services vault in North Europe
Configure backup policies in the new vault
Enable protection for VM3 and VM4
Configure any necessary extensions
Therefore, creating a new Recovery Services vault is the first and necessary step to protect VM3 and VM4, as they are in a different region from the existing vault.
You have an Azure subscription named AZPT1 that contains the resources shown in the following table:
— —
Name Type
storagel Azure Storage account
VNET1 Virtual network
VM1 Azure virtual machine
VM1Managed Managed disk for VM1
RVAULT1 Recovery Services vault for the site recovery of VM1
— —
You create a new Azure subscription named AZPT2.
You need to identify which resources can be moved to AZPT2.
Which resources should you identify?
A. VM1, storage1, VNET1, and VM1Managed only
B. VM1 and VM1Managed only
C. VM1, storage1, VNET1, VM1Managed, and RVAULT1
D. RVAULT1 only
Name | Type |
Understanding Azure Resource Moves
Cross-Subscription Moves: Moving resources to a different Azure subscription is possible for many resource types.
Resource Dependencies: Some resources have dependencies on other resources, which must be moved together, or in the correct order.
Resource Types: Not all resource types support cross-subscription moves.
Virtual Machines: Virtual machines depend on multiple resources such as their disks, network interface and virtual network.
Managed Disk: Managed disks do not depend on the virtual machine and can be moved independently.
Recovery service vault: These resources are not tied to other resources.
Analyzing the Resources
storage1: Azure Storage account.
VNET1: Virtual network.
VM1: Azure virtual machine.
VM1Managed: Managed disk for VM1.
RVAULT1: Recovery Services vault for the site recovery of VM1.
Determining Movable Resources
Let’s analyze which resources can be moved to AZPT2 and if they have dependencies:
storage1: Storage accounts can be moved to a different subscription.
VNET1: Virtual networks can be moved to a different subscription, but a virtual machine cannot be moved to a different subscription if its virtual network remains behind.
VM1: Virtual machines can be moved to a different subscription if all its associated resources are also moved, such as disks and network interfaces.
VM1Managed: Managed disks can be moved independently of the virtual machine.
RVAULT1: Recovery Services vaults can be moved to a different subscription, and they are not tied to a specific virtual machine.
The Correct Set of Resources to Move
Based on the analysis, the resources that can be moved to AZPT2 are: VM1, storage1, VNET1, VM1Managed, and RVAULT1
Answer:
C. VM1, storage1, VNET1, VM1Managed, and RVAULT1
You have the Azure virtual machines shown in the following table:
Name Azure region
VM1 West Europe
VM2 West Europe
VM3 North Europe
VM4 North Europe
You have a Recovery Services vault that protects VM1 and VM2.
You need to protect VM3 and VM4 by using Recovery Services.
What should you do first?
A. Create a new Recovery Services vault
B. Create a storage account
C. Configure the extensions for VM3 and VM4
D. Create a new backup policy
Understanding Azure Recovery Services Vaults
Recovery Services Vaults: Used for backing up Azure virtual machines and other workloads.
Region Scope: A Recovery Services vault can only protect resources in the same Azure region.
VM Protection: To protect a VM using Recovery Services, it must be in the same region as the Recovery Services vault.
Analyzing the Situation
VM1 and VM2: Located in West Europe, protected by a Recovery Services vault.
VM3 and VM4: Located in North Europe, needing protection.
Current Vault: A vault already exists in West Europe that does not contain the VMs.
Determining the First Action
Let’s evaluate the options:
A. Create a new Recovery Services vault
Analysis: This is the correct first action. Since VM3 and VM4 are in North Europe, you need to create a new Recovery Services vault in the North Europe region, as the current vault is in West Europe.
B. Create a storage account
Analysis: A storage account is required for some backups, but is not the first step in this process. This step is incorrect.
C. Configure the extensions for VM3 and VM4
Analysis: Extensions are related to VM configuration and are not necessary to be configured before creating a new vault for the virtual machines. This option is incorrect.
D. Create a new backup policy
Analysis: A backup policy is required, but a vault must be created before policies can be created. This option is incorrect.
The Correct First Step
The correct first action is to create a new Recovery Services vault in the North Europe region.
Answer:
A. Create a new Recovery Services vault
You have an Azure subscription that contains the vaults shown in the following table.
|—|—|
| Recovery1 | Recovery Services vault |
| Backup1 | Azure Backup vault |
You deploy the virtual machines shown in the following table.
You have the backup policies shown in the following table.
| Name | Type | In vault |
|—|—|—|
| Policy1 | Standard | Recovery1 |
| Policy2 | Enhanced | Recovery2 |
| Policy3 | Not applicable | Backup1 |
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Answer Area
Statements Yes No
VM1 can be backed up by using Policy1.
VM2 can be backed up by using Policy3.
VM2 can be backed up by using Policy2.
| Name | Type |
Name | Operating system | Security Configuration |
|—|—|—|
| VM1 | Windows Server | Azure Disk Encryption |
| VM2 | Linux | Trusted launch |
Understanding Azure Backup Policies and Vaults
Recovery Services Vault: The original type of vault for protecting Azure virtual machines, SQL servers and file shares.
Azure Backup Vault: A newer type of vault that is used to protect virtual machines, Azure databases and other resources.
Backup Policies: Define how backups are performed (frequency, retention).
Standard Policy: A policy for VMs that do not require enhanced features.
Enhanced Policy: A newer type of policy that provides enhanced features, such as trusted launch.
Azure Disk Encryption (ADE): A feature which provides disk encryption for virtual machines, and needs to be considered when creating backup policies.
Trusted Launch: A secure method of booting virtual machines.
Analyzing the Resources
Recovery1: Recovery Services vault, contains Policy1 (Standard).
Backup1: Azure Backup vault, contains Policy3 (Not applicable).
Policy2: Enhanced policy, in Recovery2 which is not in the table.
VM1: Windows Server with Azure Disk Encryption (ADE).
VM2: Linux VM with Trusted launch.
Analyzing the Statements
“VM1 can be backed up by using Policy1.”
Analysis: Policy1 is a standard policy in a Recovery Services vault. Standard policies are designed for protecting virtual machines which may not use advanced configurations. Azure Disk Encryption is supported by standard policies. Therefore, VM1 can be backed up using Policy1.
Answer: Yes
“VM2 can be backed up by using Policy3.”
Analysis: Policy3 is in an Azure Backup vault. Azure Backup vaults cannot back up standard virtual machines, and therefore Policy3 is not compatible with VM2.
Answer: No
“VM2 can be backed up by using Policy2.”
Analysis: Policy2 is an Enhanced policy, which are designed to be used for virtual machines with trusted launch and other newer features. Therefore, Policy2 is compatible with VM2. However, Policy2 is in Recovery2 which is not shown in the table, meaning that VM2 cannot use Policy2 as it is in a different vault. There is also no indication which type of vault Recovery2 is, which would determine if it is compatible with VM2.
Answer: No
Answer Area
Statements Yes No
VM1 can be backed up by using Policy1. Yes
VM2 can be backed up by using Policy3. No
VM2 can be backed up by using Policy2. No
HOTSPOT -
You have two Azure App Service apps named App1 and App2. Each app has a production deployment slot and a test deployment slot.
The Backup Configuration settings for the production slots are shown in the following table:
App Backup Every Start backup schedule from Retention (Days) Keep at least one backup
App1 1 Days January 6, 2021 0 Yes
App2 1 Days January 6, 2021 30 Yes
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
Answer Area
Statements Yes No
On January 15, 2021, App1 will have only one backup in storage. ( ) ( )
On February 6, 2021, you can access the backup of the App2 test slot from January 15, 2021. ( ) ( )
On January 15, 2021, you can restore the App2 production slot backup from January 6 to the App2 test slot. ( ) ( )
Understanding Azure App Service Backups
Backup Configuration: Defines how often backups are created, when they start, and how long they are retained.
Retention (Days): Specifies how long a backup is retained before being deleted.
Keep at Least One Backup: Ensures that the most recent backup is never deleted, regardless of the retention period.
Deployment Slots: Can be backed up separately, including both production and test slots.
Analyzing the Backup Configurations
App1 Production Slot:
Backup Every: 1 Day
Start Date: January 6, 2021
Retention: 0 Days
Keep at Least One Backup: Yes
App2 Production Slot:
Backup Every: 1 Day
Start Date: January 6, 2021
Retention: 30 Days
Keep at Least One Backup: Yes
Analyzing the Statements
“On January 15, 2021, App1 will have only one backup in storage.”
Analysis: App1 has a retention period of 0 days, with the ‘Keep at least one backup’ option enabled. This means that the previous backups are immediately deleted, and there will only ever be one backup at a time. As the backups run once a day, there will always be one backup available.
Answer: Yes
“On February 6, 2021, you can access the backup of the App2 test slot from January 15, 2021.”
Analysis: The provided backup configuration is only for the production slots, there is no mention of backups of the test slots. Also, a specific backup of the test slot has not been configured, so we can assume that test slots are not backed up.
Answer: No
“On January 15, 2021, you can restore the App2 production slot backup from January 6 to the App2 test slot.”
Analysis: The daily backups of App2 will all be available. When the restore process is performed, the required date can be chosen. The restore can also be performed on a different slot from which the backup was made. As the backup of January 6 exists, it can be restored to the test slot.
Answer: Yes
Answer Area
Statements Yes No
On January 15, 2021, App1 will have only one backup in storage. Yes
On February 6, 2021, you can access the backup of the App2 test slot from January 15, 2021. No
On January 15, 2021, you can restore the App2 production slot backup from January 6 to the App2 test slot.
HOTSPOT -
You need to configure Azure Backup to back up the file shares and virtual machines.
What is the minimum number of Recovery Services vaults and backup policies you should create? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
|—|—|—|—|—|
| storage1 | Storage (general purpose v1) | West US | sharea | Azure Active Directory Domain Services (Azure AD DS) |
| storage2 | StorageV2 (general purpose v2) | East US | shareb, sharec | Disabled |
| storage3 | BlobStorage | East US 2 | Not applicable | Not applicable |
| storage4 | FileStorage | Central US | shared | Azure Active Directory Domain Services (Azure AD DS) |
| Name | IP address | Location | Connected to | |
| VM1 | 10.0.1.4 | West US | VNET1/Subnet1 | |
| VM2 | 10.0.2.4 | West US | VNET1/Subnet2 | |
| VM3 | 172.16.1.4 | Central US | VNET2/Subnet1 | |
| VM4 | 192.168.1.4 | West US | VNET3/Subnet1 | |
| VM5 | 10.0.22.4 | East US | VNET4/Subnet1 | |
Answer Area
Recovery Services vaults:
1
2
3
4
7
Backup policies:
1
2
3
4
5
6
Name | Kind | Location | File share | Identity-based access for file share |
Understanding Azure Backup and Recovery Services Vaults
Recovery Services Vault: A container for backups, where you manage the protection of Azure resources.
Backup Policies: Define the backup schedule, retention, and other backup settings for different types of resources.
Resource Location: Azure resources can only be backed up to a Recovery Services vault within the same region.
Resource Types: Different types of resources (VMs, file shares) may use different backup policies.
Vault and Policy Combinations: The number of vaults and policies depends on the location of resources and the desired backup frequency.
Azure File Share Backups: File share backups can be created to the same or another recovery services vault as virtual machines.
Analyzing the Resources
File Shares:
sharea (in storage1): West US
shareb and sharec (in storage2): East US
shared (in storage4): Central US
Virtual Machines:
VM1 and VM2: West US
VM3: Central US
VM4: West US
VM5: East US
Determining Minimum Number of Vaults and Policies
Recovery Services Vaults:
We need at least one Recovery Services vault for the West US region to back up VM1, VM2, VM4, and sharea.
We need at least one Recovery Services vault for the East US region to backup VM5, shareb and sharec.
We need at least one Recovery Services vault for the Central US region to back up VM3 and shared.
Therefore, we need a minimum of 3 Recovery Services vaults.
Backup Policies:
We can use one policy for all file shares which are supported by Recovery Services Vaults.
We can use one policy for all virtual machines which are supported by Recovery Services Vaults.
There is not any indication that different backup policies need to be used for each virtual machine or file share based on this scenario.
Therefore, we need a minimum of 2 backup policies (one for file shares and one for virtual machines).
Answer Area:
Recovery Services vaults:
3
Backup policies:
2
You have an Azure subscription named AZPT1 that contains the resources shown in the following table:
|—|—|
| storagel | Azure Storage account |
| VNET1 | Virtual network |
| VM1 | Azure virtual machine |
| VM1Managed | Managed disk for VM1 |
| RVAULT1 | Recovery Services vault for the site recovery of VM1 |
You create a new Azure subscription named AZPT2.
You need to identify which resources can be moved to AZPT2.
Which resources should you identify?
A. VM1, storage1, VNET1, and VM1Managed only
B. VM1 and VM1Managed only
C. VM1, storage1, VNET1, VM1Managed, and RVAULT1
D. RVAULT1 only
Name | Type |
Understanding Azure Resource Moves
Cross-Subscription Moves: Moving resources to a different Azure subscription is possible for many resource types.
Resource Dependencies: Some resources have dependencies on other resources, which must be moved together, or in the correct order.
Resource Types: Not all resource types support cross-subscription moves.
Virtual Machines: Virtual machines depend on multiple resources such as their disks, network interface and virtual network.
Managed Disk: Managed disks do not depend on the virtual machine and can be moved independently.
Recovery service vault: These resources are not tied to other resources.
Analyzing the Resources
storage1: Azure Storage account.
VNET1: Virtual network.
VM1: Azure virtual machine.
VM1Managed: Managed disk for VM1.
RVAULT1: Recovery Services vault for the site recovery of VM1.
Determining Movable Resources
Let’s analyze which resources can be moved to AZPT2 and if they have dependencies:
storage1: Storage accounts can be moved to a different subscription.
VNET1: Virtual networks can be moved to a different subscription, but a virtual machine cannot be moved to a different subscription if its virtual network remains behind.
VM1: Virtual machines can be moved to a different subscription if all its associated resources are also moved, such as disks and network interfaces.
VM1Managed: Managed disks can be moved independently of the virtual machine.
RVAULT1: Recovery Services vaults can be moved to a different subscription, and they are not tied to a specific virtual machine.
The Correct Set of Resources to Move
Based on the analysis, the resources that can be moved to AZPT2 are: VM1, storage1, VNET1, VM1Managed, and RVAULT1
Answer:
C. VM1, storage1, VNET1, VM1Managed, and RVAULT1
Overview
Contoso, Ltd. is a manufacturing company that has offices worldwide. Contoso works with partner organizations to bring products to market.
Contoso products are manufactured by using blueprint files that the company authors and maintains.
Existing Environment
Currently, Contoso uses multiple types of servers for business operations, including the following:
✑ File servers
✑ Domain controllers
✑ Microsoft SQL Server servers
Your network contains an Active Directory forest named contoso.com. All servers and client computers are joined to Active Directory.
You have a public-facing application named App 1.
App1 is comprised of the following three tiers:
✑ A SQL database
✑ A web front end
✑ A processing middle tier
Each tier is comprised of five virtual machines. Users access the web front end by using HTTPS only.
Requirements
Planned Changes
Contoso plans to implement the following changes to the infrastructure:
✑ Move all the tiers of App1 to Azure.
✑ Move the existing product blueprint files to Azure Blob storage.
✑ Create a hybrid directory to support an upcoming Microsoft Office 365 migration project.
Technical Requirements
Contoso must meet the following technical requirements:
✑ Move all the virtual machines for App1 to Azure.
✑ Minimize the number of open ports between the App1 tiers.
✑ Ensure that all the virtual machines for App1 are protected by backups.
✑ Copy the blueprint files to Azure over the Internet.
✑ Ensure that the blueprint files are stored in the archive storage tier.
✑ Ensure that partner access to the blueprint files is secured and temporary.
✑ Prevent user passwords or hashes of passwords from being stored in Azure.
✑ Use unmanaged standard storage for the hard disks of the virtual machines.
✑ Ensure that when users join devices to Azure Active Directory (Azure AD), the users use a mobile phone to verify their identity.
✑ Minimize administrative effort whenever possible.
User Requirements
Contoso identifies the following requirements for users:
✑ Ensure that only users who are part of a group named Pilot can join devices to Azure AD.
✑ Designate a new user named Admin1 as the service administrator of the Azure subscription.
✑ Ensure that a new user named User3 can create network objects for the Azure subscription.
You need to meet the user requirement for Admin1.
What should you do?
From the Subscriptions blade, select the subscription, and then modify the Properties.
From the Subscriptions blade, select the subscription, and then modify the Access control (IAM) settings.
From the Azure Active Directory blade, modify the Properties.
From the Azure Active Directory blade, modify the Groups.
Understanding Azure Roles and Subscriptions
Service Administrator: A legacy role that has full access to all resources within a subscription. This role is not recommended to be used.
Azure Role-Based Access Control (RBAC): A more granular method for managing access to Azure resources using roles and scopes.
Subscription Scope: RBAC roles can be assigned at different levels of scope (management group, subscription, resource group, or resource level).
Access Control (IAM): The correct area to set user permissions to Azure resources.
Analyzing the Requirements
Admin1: Needs to be the service administrator of the Azure subscription.
User Requirements: Admin1 must also receive email alerts regarding service outages.
Analyzing the Options
Let’s evaluate each option:
From the Subscriptions blade, select the subscription, and then modify the Properties.
Analysis: Modifying subscription properties does not grant users administrative permissions. This option is incorrect.
From the Subscriptions blade, select the subscription, and then modify the Access control (IAM) settings.
Analysis: This is the correct approach. The Access control (IAM) settings for a subscription allow you to grant roles to users, groups, and service principals. The owner role will provide the required access, and will also grant access to email alerts regarding service outages.
From the Azure Active Directory blade, modify the Properties.
Analysis: Modifying the Azure AD properties does not provide access to Azure subscriptions. This option is incorrect.
From the Azure Active Directory blade, modify the Groups.
Analysis: Modifying groups in Azure AD does not grant administrative access to the Azure subscriptions. This is not the correct action. This option is incorrect.
The Correct Solution
The correct solution is to modify the Access control (IAM) settings of the Azure subscription. You can then assign the owner role to User Admin1.
Answer:
From the Subscriptions blade, select the subscription, and then modify the Access control (IAM) settings.
Overview
Contoso, Ltd. is a manufacturing company that has offices worldwide. Contoso works with partner organizations to bring products to market.
Contoso products are manufactured by using blueprint files that the company authors and maintains.
Existing Environment
Currently, Contoso uses multiple types of servers for business operations, including the following:
✑ File servers
✑ Domain controllers
✑ Microsoft SQL Server servers
Your network contains an Active Directory forest named contoso.com. All servers and client computers are joined to Active Directory.
You have a public-facing application named App 1.
App1 is comprised of the following three tiers:
✑ A SQL database
✑ A web front end
✑ A processing middle tier
Each tier is comprised of five virtual machines. Users access the web front end by using HTTPS only.
Requirements
Planned Changes
Contoso plans to implement the following changes to the infrastructure:
✑ Move all the tiers of App1 to Azure.
✑ Move the existing product blueprint files to Azure Blob storage.
✑ Create a hybrid directory to support an upcoming Microsoft Office 365 migration project.
Technical Requirements
Contoso must meet the following technical requirements:
✑ Move all the virtual machines for App1 to Azure.
✑ Minimize the number of open ports between the App1 tiers.
✑ Ensure that all the virtual machines for App1 are protected by backups.
✑ Copy the blueprint files to Azure over the Internet.
✑ Ensure that the blueprint files are stored in the archive storage tier.
✑ Ensure that partner access to the blueprint files is secured and temporary.
✑ Prevent user passwords or hashes of passwords from being stored in Azure.
✑ Use unmanaged standard storage for the hard disks of the virtual machines.
✑ Ensure that when users join devices to Azure Active Directory (Azure AD), the users use a mobile phone to verify their identity.
✑ Minimize administrative effort whenever possible.
User Requirements
Contoso identifies the following requirements for users:
✑ Ensure that only users who are part of a group named Pilot can join devices to Azure AD.
✑ Designate a new user named Admin1 as the service administrator of the Azure subscription.
✑ Ensure that a new user named User3 can create network objects for the Azure subscription.
You need to move the blueprint files to Azure.
What should you do?
Generate a shared access signature (SAS). Map a drive, and then copy the files by using File Explorer.
Use the Azure Import/Export service.
Generate an access key. Map a drive, and then copy the files by using File Explorer.
Use Azure Storage Explorer to copy the files.
Understanding Azure Storage Upload Options
Azure Blob Storage: Service for storing large amounts of unstructured data, such as the blueprint files.
Shared Access Signature (SAS): A URI that grants delegated access to Azure Storage resources for a specified time.
Access Keys: Provide full access to a storage account. Should be avoided for external access.
Azure Storage Explorer: A client application that allows you to browse and manage Azure Storage resources.
Azure Import/Export Service: A service to send large amounts of data to a Microsoft Data Center using a hard drive.
Analyzing the Requirements
Blueprint Files to Blob Storage: Move blueprint files to Azure Blob storage.
Over the Internet: Use an internet connection for the transfer.
Blueprint files: These are normal files that can be copied via many methods.
Analyzing the Options
Let’s evaluate the options:
Generate a shared access signature (SAS). Map a drive, and then copy the files by using File Explorer.
Analysis: While you can use a SAS to access the blob storage, you cannot use map a drive directly, and copy files by using file explorer. This approach is not suitable. This option is incorrect.
Use the Azure Import/Export service.
Analysis: This is a method that involves sending hard drives to a Microsoft data center, and it is designed for transferring large amounts of data when internet speeds are a constraint. The requirements state that the data should be copied over the internet. This option is incorrect.
Generate an access key. Map a drive, and then copy the files by using File Explorer.
Analysis: Using an access key to map a drive is a security risk and should not be used. Also, this is not the recommended method to copy the data to blob storage. This method is incorrect.
Use Azure Storage Explorer to copy the files.
Analysis: This is the correct approach. Azure Storage Explorer provides a graphical interface to easily upload files to Azure Blob storage over the internet, and it can use both SAS tokens and storage account keys. It is the easiest way to move the required files.
The Correct Action
The most efficient and secure method to move the files to Azure is to use Azure Storage Explorer to copy the files.
Answer:
Use Azure Storage Explorer to copy the files.
Overview
Contoso, Ltd. is a manufacturing company that has offices worldwide. Contoso works with partner organizations to bring products to market.
Contoso products are manufactured by using blueprint files that the company authors and maintains.
Existing Environment
Currently, Contoso uses multiple types of servers for business operations, including the following:
✑ File servers
✑ Domain controllers
✑ Microsoft SQL Server servers
Your network contains an Active Directory forest named contoso.com. All servers and client computers are joined to Active Directory.
You have a public-facing application named App 1.
App1 is comprised of the following three tiers:
✑ A SQL database
✑ A web front end
✑ A processing middle tier
Each tier is comprised of five virtual machines. Users access the web front end by using HTTPS only.
Requirements
Planned Changes
Contoso plans to implement the following changes to the infrastructure:
✑ Move all the tiers of App1 to Azure.
✑ Move the existing product blueprint files to Azure Blob storage.
✑ Create a hybrid directory to support an upcoming Microsoft Office 365 migration project.
Technical Requirements
Contoso must meet the following technical requirements:
✑ Move all the virtual machines for App1 to Azure.
✑ Minimize the number of open ports between the App1 tiers.
✑ Ensure that all the virtual machines for App1 are protected by backups.
✑ Copy the blueprint files to Azure over the Internet.
✑ Ensure that the blueprint files are stored in the archive storage tier.
✑ Ensure that partner access to the blueprint files is secured and temporary.
✑ Prevent user passwords or hashes of passwords from being stored in Azure.
✑ Use unmanaged standard storage for the hard disks of the virtual machines.
✑ Ensure that when users join devices to Azure Active Directory (Azure AD), the users use a mobile phone to verify their identity.
✑ Minimize administrative effort whenever possible.
User Requirements
Contoso identifies the following requirements for users:
✑ Ensure that only users who are part of a group named Pilot can join devices to Azure AD.
✑ Designate a new user named Admin1 as the service administrator of the Azure subscription.
✑ Ensure that a new user named User3 can create network objects for the Azure subscription.
You need to implement a backup solution for App1 after the application is moved.
What should you create first?
a recovery plan
an Azure Backup Server
a backup policy
a Recovery Services vault
Understanding Azure Backup
Azure Backup: A service for protecting Azure virtual machines, databases, and other workloads.
Recovery Services Vault: A container for managing backups and restores.
Backup Policy: Defines the schedule, retention, and other settings for a backup.
Azure Backup Server: An on-premises solution for backing up data and workloads that are not in Azure.
Recovery plan: Recovery plans are used for disaster recovery, and this is not part of the requirements.
Analyzing the Requirements
Backup Solution: App1 (comprising virtual machines) needs to be protected using backups.
Azure Backup: The planned solution is Azure Backup.
Determining the First Step
Let’s evaluate the options:
a recovery plan
Analysis: Recovery plans are for disaster recovery orchestration and are not required to be created before the backup vault, and are therefore not the first step in a backup process. This is incorrect.
an Azure Backup Server
Analysis: Azure Backup Server is an on-premises solution, and will not allow backups of the Azure based virtual machines. This option is incorrect.
a backup policy
Analysis: Backup policies are required but cannot be created without the existence of the Recovery services vault. Therefore, this option is incorrect.
a Recovery Services vault
Analysis: This is the correct first step. You need to create the Recovery Services vault before you can configure backup policies and back up the virtual machines. It is the main container for performing the required action.
The Correct First Step
The correct first step is to create a Recovery Services vault.
Answer:
a Recovery Services vault
Overview
Contoso, Ltd. is a manufacturing company that has offices worldwide. Contoso works with partner organizations to bring products to market.
Contoso products are manufactured by using blueprint files that the company authors and maintains.
Existing Environment
Currently, Contoso uses multiple types of servers for business operations, including the following:
✑ File servers
✑ Domain controllers
✑ Microsoft SQL Server servers
Your network contains an Active Directory forest named contoso.com. All servers and client computers are joined to Active Directory.
You have a public-facing application named App 1.
App1 is comprised of the following three tiers:
✑ A SQL database
✑ A web front end
✑ A processing middle tier
Each tier is comprised of five virtual machines. Users access the web front end by using HTTPS only.
Requirements
Planned Changes
Contoso plans to implement the following changes to the infrastructure:
✑ Move all the tiers of App1 to Azure.
✑ Move the existing product blueprint files to Azure Blob storage.
✑ Create a hybrid directory to support an upcoming Microsoft Office 365 migration project.
Technical Requirements
Contoso must meet the following technical requirements:
✑ Move all the virtual machines for App1 to Azure.
✑ Minimize the number of open ports between the App1 tiers.
✑ Ensure that all the virtual machines for App1 are protected by backups.
✑ Copy the blueprint files to Azure over the Internet.
✑ Ensure that the blueprint files are stored in the archive storage tier.
✑ Ensure that partner access to the blueprint files is secured and temporary.
✑ Prevent user passwords or hashes of passwords from being stored in Azure.
✑ Use unmanaged standard storage for the hard disks of the virtual machines.
✑ Ensure that when users join devices to Azure Active Directory (Azure AD), the users use a mobile phone to verify their identity.
✑ Minimize administrative effort whenever possible.
User Requirements
Contoso identifies the following requirements for users:
✑ Ensure that only users who are part of a group named Pilot can join devices to Azure AD.
✑ Designate a new user named Admin1 as the service administrator of the Azure subscription.
✑ Ensure that a new user named User3 can create network objects for the Azure subscription.
HOTSPOT
You need to recommend a solution for App1. The solution must meet the technical requirements.
What should you include in the recommendation? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
Number of virtual networks:
1
2
3
Number of subnets:
1
2
3
Understanding the Requirements
App1 Tiers: App1 consists of three tiers: a SQL database, a web front end, and a processing middle tier.
Minimize Open Ports: The solution must minimize open ports between the App1 tiers. This means that network isolation must be implemented for each tier.
Virtual Machines: Each tier is comprised of virtual machines.
Analyzing the Network Configuration Options
Virtual Networks:
Virtual networks provide a logical boundary for network resources.
Using a single VNet simplifies management.
Using multiple virtual networks adds security complexity, but it is not required to meet the requirement of minimizing the ports between the App1 tiers.
Subnets:
Subnets segment a virtual network, enabling you to control traffic flow with network security rules.
Separate subnets per tier can minimize the number of open ports by limiting access to each layer with NSGs.
Determining the Correct Configuration
Number of Virtual Networks:
1: A single virtual network is sufficient to meet the requirements. While multiple virtual networks could be used, this would not be the most optimal solution based on the given requirements. Using a single virtual network simplifies management without sacrificing security.
2 or 3 - These options would add more complexity than required, and are not the most cost-effective solution.
Number of Subnets:
3: Using three subnets (one for each tier) allows us to isolate each tier, and reduces the number of open ports between the tiers. A network security group could be created to only allow the ports required between the tiers.
1 or 2 - These options would not allow for isolation between the tiers.
Answer Area:
Number of virtual networks:
1
Number of subnets:
3
Overview
Contoso, Ltd. is a manufacturing company that has offices worldwide. Contoso works with partner organizations to bring products to market.
Contoso products are manufactured by using blueprint files that the company authors and maintains.
Existing Environment
Currently, Contoso uses multiple types of servers for business operations, including the following:
✑ File servers
✑ Domain controllers
✑ Microsoft SQL Server servers
Your network contains an Active Directory forest named contoso.com. All servers and client computers are joined to Active Directory.
You have a public-facing application named App 1.
App1 is comprised of the following three tiers:
✑ A SQL database
✑ A web front end
✑ A processing middle tier
Each tier is comprised of five virtual machines. Users access the web front end by using HTTPS only.
Requirements
Planned Changes
Contoso plans to implement the following changes to the infrastructure:
✑ Move all the tiers of App1 to Azure.
✑ Move the existing product blueprint files to Azure Blob storage.
✑ Create a hybrid directory to support an upcoming Microsoft Office 365 migration project.
Technical Requirements
Contoso must meet the following technical requirements:
✑ Move all the virtual machines for App1 to Azure.
✑ Minimize the number of open ports between the App1 tiers.
✑ Ensure that all the virtual machines for App1 are protected by backups.
✑ Copy the blueprint files to Azure over the Internet.
✑ Ensure that the blueprint files are stored in the archive storage tier.
✑ Ensure that partner access to the blueprint files is secured and temporary.
✑ Prevent user passwords or hashes of passwords from being stored in Azure.
✑ Use unmanaged standard storage for the hard disks of the virtual machines.
✑ Ensure that when users join devices to Azure Active Directory (Azure AD), the users use a mobile phone to verify their identity.
✑ Minimize administrative effort whenever possible.
User Requirements
Contoso identifies the following requirements for users:
✑ Ensure that only users who are part of a group named Pilot can join devices to Azure AD.
✑ Designate a new user named Admin1 as the service administrator of the Azure subscription.
✑ Ensure that a new user named User3 can create network objects for the Azure subscription.
You are planning the move of App1 to Azure.
You create a network security group (NSG).
You need to recommend a solution to provide users with access to App1.
What should you recommend?
Create an outgoing security rule for port 443 from the Internet. Associate the NSG to all the subnets.
Create an incoming security rule for port 443 from the Internet. Associate the NSG to all the subnets.
Create an incoming security rule for port 443 from the Internet. Associate the NSG to the subnet that contains the web servers.
Create an outgoing security rule for port 443 from the Internet. Associate the NSG to the subnet that contains the web servers.
Understanding Network Security Groups (NSGs)
NSG Rules: Control inbound and outbound traffic to Azure resources.
Priority: Rules are evaluated in order of priority (lower number = higher priority).
Action: Each rule has an action (Allow or Deny).
Protocol and Port: Rules specify the protocol (TCP, UDP, etc.) and port.
Source and Destination: Rules specify the source and destination of the traffic.
Inbound Rules: Control traffic entering resources.
Outbound Rules: Control traffic leaving resources.
Scope: NSGs can be applied to subnets or network interfaces.
Analyzing the Requirements
App1 Access: Users access the web front-end of App1 using HTTPS only (port 443).
NSG Purpose: We need to control traffic to App1 using network security groups.
Security Principle: Only necessary traffic should be allowed.
Analyzing the Options
“Create an outgoing security rule for port 443 from the Internet. Associate the NSG to all the subnets.”
Analysis: This is incorrect because users initiate the connection to the web application (inbound), not the other way around. Outgoing rules control traffic leaving the virtual machines. Also associating the NSG to all subnets when only the web servers need to be exposed is incorrect.
“Create an incoming security rule for port 443 from the Internet. Associate the NSG to all the subnets.”
Analysis: This is better, but it would make all subnets accessible to traffic, not just the web servers. You should restrict the rule to the subnet of the web servers. This is incorrect.
“Create an incoming security rule for port 443 from the Internet. Associate the NSG to the subnet that contains the web servers.”
Analysis: This is the correct solution. It allows HTTPS traffic from the internet to reach the web front end, and it applies the rule only to the specific subnet where the web servers are located. This is the most optimal approach.
“Create an outgoing security rule for port 443 from the Internet. Associate the NSG to the subnet that contains the web servers.”
Analysis: This option is incorrect as the users are trying to connect to the web servers and not from the web servers. Outbound rules control traffic leaving the virtual machines.
The Correct Recommendation
The most secure and appropriate solution is to create an incoming rule for port 443 from the internet, and only apply the rule to the subnet that contains the web servers.
Answer:
Create an incoming security rule for port 443 from the Internet. Associate the NSG to the subnet that contains the web servers.
Overview
Contoso, Ltd. is a manufacturing company that has offices worldwide. Contoso works with partner organizations to bring products to market.
Contoso products are manufactured by using blueprint files that the company authors and maintains.
Existing Environment
Currently, Contoso uses multiple types of servers for business operations, including the following:
✑ File servers
✑ Domain controllers
✑ Microsoft SQL Server servers
Your network contains an Active Directory forest named contoso.com. All servers and client computers are joined to Active Directory.
You have a public-facing application named App 1.
App1 is comprised of the following three tiers:
✑ A SQL database
✑ A web front end
✑ A processing middle tier
Each tier is comprised of five virtual machines. Users access the web front end by using HTTPS only.
Requirements
Planned Changes
Contoso plans to implement the following changes to the infrastructure:
✑ Move all the tiers of App1 to Azure.
✑ Move the existing product blueprint files to Azure Blob storage.
✑ Create a hybrid directory to support an upcoming Microsoft Office 365 migration project.
Technical Requirements
Contoso must meet the following technical requirements:
✑ Move all the virtual machines for App1 to Azure.
✑ Minimize the number of open ports between the App1 tiers.
✑ Ensure that all the virtual machines for App1 are protected by backups.
✑ Copy the blueprint files to Azure over the Internet.
✑ Ensure that the blueprint files are stored in the archive storage tier.
✑ Ensure that partner access to the blueprint files is secured and temporary.
✑ Prevent user passwords or hashes of passwords from being stored in Azure.
✑ Use unmanaged standard storage for the hard disks of the virtual machines.
✑ Ensure that when users join devices to Azure Active Directory (Azure AD), the users use a mobile phone to verify their identity.
✑ Minimize administrative effort whenever possible.
User Requirements
Contoso identifies the following requirements for users:
✑ Ensure that only users who are part of a group named Pilot can join devices to Azure AD.
✑ Designate a new user named Admin1 as the service administrator of the Azure subscription.
✑ Ensure that a new user named User3 can create network objects for the Azure subscription.
You need to identify the storage requirements for Contoso.
For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.
Statements
Contoso requires a storage account that supports
Blob storage.
Contoso requires a storage account that supports
Azure Table storage.
Contoso requires a storage account that supports
Azure File Storage.
Understanding the Requirements
Blueprint Files: Contoso needs to move their product blueprint files to Azure. These files will be stored in the archive storage tier and require secure, temporary access for partners.
Virtual Machine Storage: The virtual machines for App1 will use unmanaged standard storage for their hard disks.
No Direct User Requirement for Table or File Storage: The requirements do not mention other user related storage requirements.
Analyzing Storage Options
Blob Storage: Blob storage is ideal for storing unstructured data like text or binary data. In this case, the blueprint files fall under unstructured data, making Blob storage a good fit. Additionally, the requirement to use the archive tier is something that only blob storage can provide.
Table Storage: Table storage is a NoSQL key-value datastore, suitable for structured data. There’s no indication that Contoso needs this for their blueprints or virtual machine disks.
File Storage: File storage provides fully managed file shares in the cloud. The requirements focus on moving blueprint files to Azure blob storage, no requirement for a managed file share.
Answering the Statements:
Contoso requires a storage account that supports Blob storage. - Yes. The blueprint files must be stored in Blob storage, making this requirement essential.
Contoso requires a storage account that supports Azure Table storage. - No. There is no indication in the requirements that they require Table storage.
Contoso requires a storage account that supports Azure File Storage. - No. They must move blueprints to blob storage and no requirements dictate the need for Azure File storage.
Final Answer:
Statement Answer
Contoso requires a storage account that supports Blob storage. Yes
Contoso requires a storage account that supports Azure Table storage. No
Contoso requires a storage account that supports Azure File Storage. No
Overview
General Overview
Contoso, Ltd. is a consulting company that has a main office in Montreal and branch offices in Seattle and New York.
Environment
Existing Environment
Contoso has an Azure subscription named Sub1 that is linked to an Azure Active Directory (Azure AD) tenant. The network contains an on-premises Active Directory domain that syncs to the Azure AD tenant.
The Azure AD tenant contains the users shown in the following table.
Name Type Role
User1 Member None
User2 Guest None
User3 Member None
User4 Member None
Sub1 contains two resource groups named RG1 and RG2 and the virtual networks shown in the
following table.
Name Subnet Peered with
VNET1 Subnet1, Subnet2 VNET2
VNET2 Subnet1 VNET1, VNET3
VNET3 Subnet1 VNET2
VNET4 Subnet1 None
User1 manages the resources in RG1. User4 manages the resources in RG2.
Sub1 contains virtual machines that run Windows Server 2019 as shown in the following table
Name IP address Location Connected to
VM1 10.0.1.4 West US VNET1/Subnet1
VM2 10.0.2.4 West US VNET1/Subnet2
VM3 172.16.1.4 Central US VNET2/Subnet1
VM4 192.168.1.4 West US VNET3/Subnet1
VM5 10.0.22.4 East US VNET4/Subnet1
No network security groups (NSGs) are associated to the network interfaces or the subnets.
Sub1 contains the storage accounts shown in the following table.
Name Kind Location File share Identity-based
access for file share
storage1 Storage (general purpose v1) West US sharea Azure Active Directory Domain Services (Azure AD DS)
storage2 StorageV2 (general purpose v2) East US shareb, sharec Disabled
storage3 BlobStorage East US 2 Not applicable Not applicable
storage4 FileStorage Central US shared Azure Active Directory Domain Services (Azure AD DS)
Requirements
Planned Changes
Contoso plans to implement the following changes:
✑ Create a blob container named container1 and a file share named share1 that will use the Cool storage tier.
✑ Create a storage account named storage5 and configure storage replication for the Blob service.
✑ Create an NSG named NSG1 that will have the custom inbound security rules shown in the following table.
Priority Port Protocol Source Destination Action
500 3389 TCP 10.0.2.0/24 Any Deny
1000 Any ICMP Any Virtual Network Allow
Associate NSG1 to the network interface of VM1.
Create an NSG named NSG2 that will have the custom outbound security rules shown in the following table.
Priority Port Protocol Source Destination Action
200 3389 TCP 10.0.0.0/16 Virtual Network Deny
400 Any ICMP 10.0.2.0/24 10.0.1.0/24 Allow
Associate NSG2 to VNET1/Subnet2.
Technical Requirements
Contoso must meet the following technical requirements:
✑ Create container1 and share1.
✑ Use the principle of least privilege.
✑ Create an Azure AD security group named Group4.
✑ Back up the Azure file shares and virtual machines by using Azure Backup.
✑ Trigger an alert if VM1 or VM2 has less than 20 GB of free space on volume C.
✑ Enable User1 to create Azure policy definitions and User2 to assign Azure policies to RG1.
✑ Create an internal Basic Azure Load Balancer named LB1 and connect the load balancer to VNET1/Subnet1
✑ Enable flow logging for IP traffic from VM5 and retain the flow logs for a period of eight months.
✑ Whenever possible, grant Group4 Azure role-based access control (Azure RBAC) read-only permissions to the Azure file shares.
HOTSPOT
You need to create container1 and share1.
Which storage accounts should you use for each resource? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
container1:
storage2 only
storage2 and storage3 only
storage1, storage2, and storage3 only
storage2, storage3, and storage4 only
storage1, storage2, storage3, and storage4
share1:
storage2 only
storage4 only
storage2 and storage4 only
storage1, storage2, and storage4 only
storage1, storage2, storage3, and storage4
Understanding the Requirements
container1: This is a blob container, so it must reside in a storage account that supports blob storage.
share1: This is a file share, so it must reside in a storage account that supports file storage.
Cool Storage Tier: Both container1 and share1 should use the Cool storage tier.
Existing Storage Accounts: We need to examine the existing storage accounts to determine which can meet the requirements.
Analyzing the Storage Accounts
Here’s a breakdown of each storage account:
storage1:
Kind: Storage (general purpose v1)
Location: West US
File share: sharea
Identity-based access: Azure AD DS
Analysis: General purpose v1 can host both blob containers and file shares. However it does not support the Cool storage tier.
storage2:
Kind: StorageV2 (general purpose v2)
Location: East US
File share: shareb, sharec
Identity-based access: Disabled
Analysis: General purpose v2 accounts can host both blob containers and file shares, it also supports the Cool storage tier
storage3:
Kind: BlobStorage
Location: East US 2
File share: Not applicable
Identity-based access: Not applicable
Analysis: Supports only Blob storage and also supports the cool tier.
storage4:
Kind: FileStorage
Location: Central US
File share: shared
Identity-based access: Azure AD DS
Analysis: Supports only File shares. Also supports the Cool tier.
Determining the Correct Storage Accounts
container1:
Can use storage2 as it supports general purpose v2, cool storage and blob containers. It can also use storage3 as it supports the cool tier and is a blob storage account.
storage1 is not applicable, as it does not support the cool tier.
storage4 is not applicable, as it only supports file shares.
Therefore, the correct options are storage2 and storage3 only.
share1:
Can use storage2 as it supports general purpose v2, cool storage and file shares. It can also use storage4 as it is a FileStorage account and supports the cool tier.
storage1 is not applicable as it does not support the cool tier.
storage3 is not applicable as it only supports blob storage.
Therefore, the correct options are storage2 and storage4 only.
Answer:
container1: storage2 and storage3 only
share1: storage2 and storage4 only
Overview
General Overview
Contoso, Ltd. is a consulting company that has a main office in Montreal and branch offices in Seattle and New York.
Environment
Existing Environment
Contoso has an Azure subscription named Sub1 that is linked to an Azure Active Directory (Azure AD) tenant. The network contains an on-premises Active Directory domain that syncs to the Azure AD tenant.
The Azure AD tenant contains the users shown in the following table.
Name Type Role
User1 Member None
User2 Guest None
User3 Member None
User4 Member None
Sub1 contains two resource groups named RG1 and RG2 and the virtual networks shown in the
following table.
Name Subnet Peered with
VNET1 Subnet1, Subnet2 VNET2
VNET2 Subnet1 VNET1, VNET3
VNET3 Subnet1 VNET2
VNET4 Subnet1 None
User1 manages the resources in RG1. User4 manages the resources in RG2.
Sub1 contains virtual machines that run Windows Server 2019 as shown in the following table
Name IP address Location Connected to
VM1 10.0.1.4 West US VNET1/Subnet1
VM2 10.0.2.4 West US VNET1/Subnet2
VM3 172.16.1.4 Central US VNET2/Subnet1
VM4 192.168.1.4 West US VNET3/Subnet1
VM5 10.0.22.4 East US VNET4/Subnet1
No network security groups (NSGs) are associated to the network interfaces or the subnets.
Sub1 contains the storage accounts shown in the following table.
Name Kind Location File share Identity-based
access for file share
storage1 Storage (general purpose v1) West US sharea Azure Active Directory Domain Services (Azure AD DS)
storage2 StorageV2 (general purpose v2) East US shareb, sharec Disabled
storage3 BlobStorage East US 2 Not applicable Not applicable
storage4 FileStorage Central US shared Azure Active Directory Domain Services (Azure AD DS)
Requirements
Planned Changes
Contoso plans to implement the following changes:
✑ Create a blob container named container1 and a file share named share1 that will use the Cool storage tier.
✑ Create a storage account named storage5 and configure storage replication for the Blob service.
✑ Create an NSG named NSG1 that will have the custom inbound security rules shown in the following table.
Priority Port Protocol Source Destination Action
500 3389 TCP 10.0.2.0/24 Any Deny
1000 Any ICMP Any Virtual Network Allow
Associate NSG1 to the network interface of VM1.
Create an NSG named NSG2 that will have the custom outbound security rules shown in the following table.
Priority Port Protocol Source Destination Action
200 3389 TCP 10.0.0.0/16 Virtual Network Deny
400 Any ICMP 10.0.2.0/24 10.0.1.0/24 Allow
Associate NSG2 to VNET1/Subnet2.
Technical Requirements
Contoso must meet the following technical requirements:
✑ Create container1 and share1.
✑ Use the principle of least privilege.
✑ Create an Azure AD security group named Group4.
✑ Back up the Azure file shares and virtual machines by using Azure Backup.
✑ Trigger an alert if VM1 or VM2 has less than 20 GB of free space on volume C.
✑ Enable User1 to create Azure policy definitions and User2 to assign Azure policies to RG1.
✑ Create an internal Basic Azure Load Balancer named LB1 and connect the load balancer to VNET1/Subnet1
✑ Enable flow logging for IP traffic from VM5 and retain the flow logs for a period of eight months.
✑ Whenever possible, grant Group4 Azure role-based access control (Azure RBAC) read-only permissions to the Azure file shares.
HOTSPOT
You need to create storage5. The solution must support the planned changes.
Which type of storage account should you use, and which account should you configure as the destination storage account? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
Account kind:
BlobStorage
BlockBlobStorage
Storage (general purpose v1)
StorageV2 (general purpose v2)
Destination:
Storage1
Storage2
Storage3
Storage4
Understanding Azure Storage Account Types
General-purpose v1: Legacy storage account type supporting blobs, tables, queues, and files.
General-purpose v2: The recommended type for most scenarios, supporting blobs, tables, queues, and files. It offers lower storage costs.
BlobStorage: Designed solely for storing blobs.
FileStorage: Designed solely for storing Azure file shares.
Storage Replication: Replicates data to protect against outages, and this is specifically required for storage5.
Blob Service: Storage replication is specific to blob storage.
Analyzing the Requirements
storage5: Must support storage replication for the Blob service.
Planned changes: Specifically mentions the need for blob replication for this storage account.
Determining Correct Account Kind and Destination
Let’s evaluate the options:
Account kind:
BlobStorage: This is a valid option as it is a storage account designed for storing blobs, and it also supports the blob storage replication requirement.
BlockBlobStorage: This is not a valid storage account type. This option is incorrect.
Storage (general purpose v1): While a general purpose v1 account can store blobs, it does not support blob storage replication, and is a legacy storage account. This option is incorrect.
StorageV2 (general purpose v2): This is a valid option as it is a general purpose storage account, and it supports the blob storage replication requirement.
Destination: The destination options refer to other existing storage accounts, rather than to a replication destination. As per the requirements, storage5 is the storage account that needs to have replication configured. As we are configuring blob storage replication, this is not a required setting. The option must be storage5 which is not included as an option.
Therefore, the only correct option for the destination is “None of the above”, which is not a selectable option, therefore that part of the question will not be answerable.
Answer:
Account kind: StorageV2 (general purpose v2)
BlobStorage
Destination: None of the above (Not a selectable option)
Destination: “storage2”
Overview
General Overview
Contoso, Ltd. is a consulting company that has a main office in Montreal and branch offices in Seattle and New York.
Environment
Existing Environment
Contoso has an Azure subscription named Sub1 that is linked to an Azure Active Directory (Azure AD) tenant. The network contains an on-premises Active Directory domain that syncs to the Azure AD tenant.
The Azure AD tenant contains the users shown in the following table.
Name Type Role
User1 Member None
User2 Guest None
User3 Member None
User4 Member None
Sub1 contains two resource groups named RG1 and RG2 and the virtual networks shown in the
following table.
Name Subnet Peered with
VNET1 Subnet1, Subnet2 VNET2
VNET2 Subnet1 VNET1, VNET3
VNET3 Subnet1 VNET2
VNET4 Subnet1 None
User1 manages the resources in RG1. User4 manages the resources in RG2.
Sub1 contains virtual machines that run Windows Server 2019 as shown in the following table
Name IP address Location Connected to
VM1 10.0.1.4 West US VNET1/Subnet1
VM2 10.0.2.4 West US VNET1/Subnet2
VM3 172.16.1.4 Central US VNET2/Subnet1
VM4 192.168.1.4 West US VNET3/Subnet1
VM5 10.0.22.4 East US VNET4/Subnet1
No network security groups (NSGs) are associated to the network interfaces or the subnets.
Sub1 contains the storage accounts shown in the following table.
Name Kind Location File share Identity-based
access for file share
storage1 Storage (general purpose v1) West US sharea Azure Active Directory Domain Services (Azure AD DS)
storage2 StorageV2 (general purpose v2) East US shareb, sharec Disabled
storage3 BlobStorage East US 2 Not applicable Not applicable
storage4 FileStorage Central US shared Azure Active Directory Domain Services (Azure AD DS)
Requirements
Planned Changes
Contoso plans to implement the following changes:
✑ Create a blob container named container1 and a file share named share1 that will use the Cool storage tier.
✑ Create a storage account named storage5 and configure storage replication for the Blob service.
✑ Create an NSG named NSG1 that will have the custom inbound security rules shown in the following table.
Priority Port Protocol Source Destination Action
500 3389 TCP 10.0.2.0/24 Any Deny
1000 Any ICMP Any Virtual Network Allow
Associate NSG1 to the network interface of VM1.
Create an NSG named NSG2 that will have the custom outbound security rules shown in the following table.
Priority Port Protocol Source Destination Action
200 3389 TCP 10.0.0.0/16 Virtual Network Deny
400 Any ICMP 10.0.2.0/24 10.0.1.0/24 Allow
Associate NSG2 to VNET1/Subnet2.
Technical Requirements
Contoso must meet the following technical requirements:
✑ Create container1 and share1.
✑ Use the principle of least privilege.
✑ Create an Azure AD security group named Group4.
✑ Back up the Azure file shares and virtual machines by using Azure Backup.
✑ Trigger an alert if VM1 or VM2 has less than 20 GB of free space on volume C.
✑ Enable User1 to create Azure policy definitions and User2 to assign Azure policies to RG1.
✑ Create an internal Basic Azure Load Balancer named LB1 and connect the load balancer to VNET1/Subnet1
✑ Enable flow logging for IP traffic from VM5 and retain the flow logs for a period of eight months.
✑ Whenever possible, grant Group4 Azure role-based access control (Azure RBAC) read-only permissions to the Azure file shares.
HOTSPOT
You need to ensure that User1 can create initiative definitions, and User4 can assign initiatives to RG2. The solution must meet the technical requirements.
Which role should you assign to each user? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.
User1:
Contributor for RG1
Contributor for Sub1
Security Admin for RG1
Resource Policy Contributor for Sub1
User4:
Contributor for RG2
Contributor for Sub1
Security Admin for Sub1
Resource Policy Contributor for RG2
User1:
Resource Policy Contributor for Sub1
User4:
Resource Policy Contributor for RG2
Overview
General Overview
Contoso, Ltd. is a consulting company that has a main office in Montreal and branch offices in Seattle and New York.
Environment
Existing Environment
Contoso has an Azure subscription named Sub1 that is linked to an Azure Active Directory (Azure AD) tenant. The network contains an on-premises Active Directory domain that syncs to the Azure AD tenant.
The Azure AD tenant contains the users shown in the following table.
Name Type Role
User1 Member None
User2 Guest None
User3 Member None
User4 Member None
Sub1 contains two resource groups named RG1 and RG2 and the virtual networks shown in the
following table.
Name Subnet Peered with
VNET1 Subnet1, Subnet2 VNET2
VNET2 Subnet1 VNET1, VNET3
VNET3 Subnet1 VNET2
VNET4 Subnet1 None
User1 manages the resources in RG1. User4 manages the resources in RG2.
Sub1 contains virtual machines that run Windows Server 2019 as shown in the following table
Name IP address Location Connected to
VM1 10.0.1.4 West US VNET1/Subnet1
VM2 10.0.2.4 West US VNET1/Subnet2
VM3 172.16.1.4 Central US VNET2/Subnet1
VM4 192.168.1.4 West US VNET3/Subnet1
VM5 10.0.22.4 East US VNET4/Subnet1
No network security groups (NSGs) are associated to the network interfaces or the subnets.
Sub1 contains the storage accounts shown in the following table.
Name Kind Location File share Identity-based
access for file share
storage1 Storage (general purpose v1) West US sharea Azure Active Directory Domain Services (Azure AD DS)
storage2 StorageV2 (general purpose v2) East US shareb, sharec Disabled
storage3 BlobStorage East US 2 Not applicable Not applicable
storage4 FileStorage Central US shared Azure Active Directory Domain Services (Azure AD DS)
Requirements
Planned Changes
Contoso plans to implement the following changes:
✑ Create a blob container named container1 and a file share named share1 that will use the Cool storage tier.
✑ Create a storage account named storage5 and configure storage replication for the Blob service.
✑ Create an NSG named NSG1 that will have the custom inbound security rules shown in the following table.
Priority Port Protocol Source Destination Action
500 3389 TCP 10.0.2.0/24 Any Deny
1000 Any ICMP Any Virtual Network Allow
Associate NSG1 to the network interface of VM1.
Create an NSG named NSG2 that will have the custom outbound security rules shown in the following table.
Priority Port Protocol Source Destination Action
200 3389 TCP 10.0.0.0/16 Virtual Network Deny
400 Any ICMP 10.0.2.0/24 10.0.1.0/24 Allow
Associate NSG2 to VNET1/Subnet2.
Technical Requirements
Contoso must meet the following technical requirements:
✑ Create container1 and share1.
✑ Use the principle of least privilege.
✑ Create an Azure AD security group named Group4.
✑ Back up the Azure file shares and virtual machines by using Azure Backup.
✑ Trigger an alert if VM1 or VM2 has less than 20 GB of free space on volume C.
✑ Enable User1 to create Azure policy definitions and User2 to assign Azure policies to RG1.
✑ Create an internal Basic Azure Load Balancer named LB1 and connect the load balancer to VNET1/Subnet1
✑ Enable flow logging for IP traffic from VM5 and retain the flow logs for a period of eight months.
✑ Whenever possible, grant Group4 Azure role-based access control (Azure RBAC) read-only permissions to the Azure file shares.
You need to ensure that you can grant Group4 Azure RBAC read-only permissions to all the A2ure file shares.
What should you do?
On storagel and storage4, change the Account kind type to StorageV2 (general purpose v2).
Recreate storage2 and set Hierarchical namespace to Enabled.
On storage2, enable identity-based access for the file shares.
Create a shared access signature (SAS) for storagel, storage2, and storage4.
Understanding Azure File Shares and RBAC
Azure File Shares: Managed file shares hosted in Azure storage accounts.
Azure RBAC: Azure role-based access control provides fine-grained access management for Azure resources.
Identity-Based Access: RBAC on file shares requires identity-based access, where permissions are granted to Azure AD identities (users, groups).
Shared Access Signature (SAS): SAS provides temporary, delegated access to storage resources, but it is not an RBAC method.
Hierarchical Namespace: A feature of Azure Data Lake Storage Gen2, which is not necessary for RBAC for Azure File shares.
Analyzing the Options
“On storage1 and storage4, change the Account kind type to StorageV2 (general purpose v2).”
Analysis: Changing to StorageV2 is not required to enable RBAC on storage accounts, though Storage v2 is the recommended storage account type. This is not the correct option to apply RBAC to file shares.
“Recreate storage2 and set Hierarchical namespace to Enabled.”
Analysis: Hierarchical namespace is a feature of Azure Data Lake Storage Gen2, and is not required to apply RBAC to Azure file shares. Recreating the storage account is not the right action.
“On storage2, enable identity-based access for the file shares.”
Analysis: This is the correct approach. Enabling identity-based access is required to use RBAC to grant permissions to groups. Once enabled, you can use RBAC to grant permissions to Group4.
“Create a shared access signature (SAS) for storage1, storage2, and storage4.”
Analysis: SAS provides temporary, delegated access. It does not allow granting permissions using Azure RBAC for a group. This option is incorrect.
The Correct Solution
To grant Group4 read-only permissions to Azure file shares using RBAC, we must enable identity-based access for the file shares. We can then grant the appropriate RBAC permissions to Group4.
Answer:
On storage2, enable identity-based access for the file shares.
Overview
General Overview
Contoso, Ltd. is a consulting company that has a main office in Montreal and branch offices in Seattle and New York.
Environment
Existing Environment
Contoso has an Azure subscription named Sub1 that is linked to an Azure Active Directory (Azure AD) tenant. The network contains an on-premises Active Directory domain that syncs to the Azure AD tenant.
The Azure AD tenant contains the users shown in the following table.
Name Type Role
User1 Member None
User2 Guest None
User3 Member None
User4 Member None
Sub1 contains two resource groups named RG1 and RG2 and the virtual networks shown in the
following table.
Name Subnet Peered with
VNET1 Subnet1, Subnet2 VNET2
VNET2 Subnet1 VNET1, VNET3
VNET3 Subnet1 VNET2
VNET4 Subnet1 None
User1 manages the resources in RG1. User4 manages the resources in RG2.
Sub1 contains virtual machines that run Windows Server 2019 as shown in the following table
Name IP address Location Connected to
VM1 10.0.1.4 West US VNET1/Subnet1
VM2 10.0.2.4 West US VNET1/Subnet2
VM3 172.16.1.4 Central US VNET2/Subnet1
VM4 192.168.1.4 West US VNET3/Subnet1
VM5 10.0.22.4 East US VNET4/Subnet1
No network security groups (NSGs) are associated to the network interfaces or the subnets.
Sub1 contains the storage accounts shown in the following table.
Name Kind Location File share Identity-based
access for file share
storage1 Storage (general purpose v1) West US sharea Azure Active Directory Domain Services (Azure AD DS)
storage2 StorageV2 (general purpose v2) East US shareb, sharec Disabled
storage3 BlobStorage East US 2 Not applicable Not applicable
storage4 FileStorage Central US shared Azure Active Directory Domain Services (Azure AD DS)
Requirements
Planned Changes
Contoso plans to implement the following changes:
✑ Create a blob container named container1 and a file share named share1 that will use the Cool storage tier.
✑ Create a storage account named storage5 and configure storage replication for the Blob service.
✑ Create an NSG named NSG1 that will have the custom inbound security rules shown in the following table.
Priority Port Protocol Source Destination Action
500 3389 TCP 10.0.2.0/24 Any Deny
1000 Any ICMP Any Virtual Network Allow
Associate NSG1 to the network interface of VM1.
Create an NSG named NSG2 that will have the custom outbound security rules shown in the following table.
Priority Port Protocol Source Destination Action
200 3389 TCP 10.0.0.0/16 Virtual Network Deny
400 Any ICMP 10.0.2.0/24 10.0.1.0/24 Allow
Associate NSG2 to VNET1/Subnet2.
Technical Requirements
Contoso must meet the following technical requirements:
✑ Create container1 and share1.
✑ Use the principle of least privilege.
✑ Create an Azure AD security group named Group4.
✑ Back up the Azure file shares and virtual machines by using Azure Backup.
✑ Trigger an alert if VM1 or VM2 has less than 20 GB of free space on volume C.
✑ Enable User1 to create Azure policy definitions and User2 to assign Azure policies to RG1.
✑ Create an internal Basic Azure Load Balancer named LB1 and connect the load balancer to VNET1/Subnet1
✑ Enable flow logging for IP traffic from VM5 and retain the flow logs for a period of eight months.
✑ Whenever possible, grant Group4 Azure role-based access control (Azure RBAC) read-only permissions to the Azure file shares.
HOTSPOT
You implement the planned changes for NSG1 and NSG2.
For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.
Statements
From VM1, you can establish a Remote Desktop session to VM2.
From VM2, you can ping VM3.
From VM2, you can establish a Remote Desktop session to VM3.
Understanding Network Security Groups (NSGs)
NSG Rules: Control inbound and outbound traffic to Azure resources.
Priority: Rules are evaluated in order of priority (lower number = higher priority).
Action: Each rule has an action (Allow or Deny).
Protocol and Port: Rules specify the protocol (TCP, UDP, etc.) and port.
Source and Destination: Rules specify the source and destination of the traffic.
Default Rules: NSGs have default rules allowing outbound traffic, and blocking all inbound from the internet.
Network Interface Association: NSGs can be associated with a network interface or a subnet.
Analyzing the Resources
VM1:
IP address: 10.0.1.4
Location: West US
Connected to: VNET1/Subnet1
NSG: NSG1 (associated to the network interface)
VM2:
IP address: 10.0.2.4
Location: West US
Connected to: VNET1/Subnet2
NSG: NSG2 (associated to the subnet)
VM3:
IP address: 172.16.1.4
Location: Central US
Connected to: VNET2/Subnet1
NSG: None
NSG1: Applied to the network interface of VM1
Inbound Rules:
Priority 500: Deny TCP 3389 from 10.0.2.0/24 to any destination.
Priority 1000: Allow ICMP from any source to the virtual network.
NSG2: Applied to VNET1/Subnet2
Outbound Rules:
Priority 200: Deny TCP 3389 from 10.0.0.0/16 to any virtual network destination.
Priority 400: Allow ICMP from 10.0.2.0/24 to 10.0.1.0/24.
Analyzing the Statements
“From VM1, you can establish a Remote Desktop session to VM2.”
Analysis: VM1 is connected to Subnet1, which does not have an NSG associated. VM2 is connected to Subnet2 and has an NSG associated. VM1 would initiate an outbound RDP connection to VM2. As NSG2 is an outbound rule, it will not affect traffic to the VM, and the outbound default allow rule will allow traffic to VM2. The NSG applied to the network interface of VM1 denies inbound traffic from 10.0.2.0/24 on port 3389. This means that the traffic from VM2 will be denied at the VM1 network interface. The default rules of the network security group allow outbound traffic, and therefore VM1 can reach VM2. However, inbound traffic will be blocked on VM1. Therefore VM1 will not be able to establish a remote desktop session.
Answer: No
“From VM2, you can ping VM3.”
Analysis: VM2 is on Subnet2, and has NSG2 associated with the subnet. The allow rule for ICMP is for traffic from 10.0.2.0/24 (Subnet2), and to 10.0.1.0/24, which is not VM3, so ping will be blocked. Also, VM3 is in a separate virtual network, and not peered to VNET1, so communication will not be possible. Therefore, VM2 cannot ping VM3.
Answer: No
“From VM2, you can establish a Remote Desktop session to VM3.”
Analysis: VM2 is on Subnet2, and has NSG2 associated with the subnet. The deny rule for RDP is from 10.0.0.0/16, which means that VM2 would be denied as well, also VM3 is in a different virtual network which is not connected to VNET1 or Subnet2, so access is not possible. Therefore, VM2 cannot access VM3.
Answer: No
Answer Area:
Statements Yes No
From VM1, you can establish a Remote Desktop session to VM2. No
From VM2, you can ping VM3. No
From VM2, you can establish a Remote Desktop session to VM3. No
Overview
General Overview
Contoso, Ltd. is a consulting company that has a main office in Montreal and branch offices in Seattle and New York.
Environment
Existing Environment
Contoso has an Azure subscription named Sub1 that is linked to an Azure Active Directory (Azure AD) tenant. The network contains an on-premises Active Directory domain that syncs to the Azure AD tenant.
The Azure AD tenant contains the users shown in the following table.
Name Type Role
User1 Member None
User2 Guest None
User3 Member None
User4 Member None
Sub1 contains two resource groups named RG1 and RG2 and the virtual networks shown in the
following table.
Name Subnet Peered with
VNET1 Subnet1, Subnet2 VNET2
VNET2 Subnet1 VNET1, VNET3
VNET3 Subnet1 VNET2
VNET4 Subnet1 None
User1 manages the resources in RG1. User4 manages the resources in RG2.
Sub1 contains virtual machines that run Windows Server 2019 as shown in the following table
Name IP address Location Connected to
VM1 10.0.1.4 West US VNET1/Subnet1
VM2 10.0.2.4 West US VNET1/Subnet2
VM3 172.16.1.4 Central US VNET2/Subnet1
VM4 192.168.1.4 West US VNET3/Subnet1
VM5 10.0.22.4 East US VNET4/Subnet1
No network security groups (NSGs) are associated to the network interfaces or the subnets.
Sub1 contains the storage accounts shown in the following table.
Name Kind Location File share Identity-based
access for file share
storage1 Storage (general purpose v1) West US sharea Azure Active Directory Domain Services (Azure AD DS)
storage2 StorageV2 (general purpose v2) East US shareb, sharec Disabled
storage3 BlobStorage East US 2 Not applicable Not applicable
storage4 FileStorage Central US shared Azure Active Directory Domain Services (Azure AD DS)
Requirements
Planned Changes
Contoso plans to implement the following changes:
✑ Create a blob container named container1 and a file share named share1 that will use the Cool storage tier.
✑ Create a storage account named storage5 and configure storage replication for the Blob service.
✑ Create an NSG named NSG1 that will have the custom inbound security rules shown in the following table.
Priority Port Protocol Source Destination Action
500 3389 TCP 10.0.2.0/24 Any Deny
1000 Any ICMP Any Virtual Network Allow
Associate NSG1 to the network interface of VM1.
Create an NSG named NSG2 that will have the custom outbound security rules shown in the following table.
Priority Port Protocol Source Destination Action
200 3389 TCP 10.0.0.0/16 Virtual Network Deny
400 Any ICMP 10.0.2.0/24 10.0.1.0/24 Allow
Associate NSG2 to VNET1/Subnet2.
Technical Requirements
Contoso must meet the following technical requirements:
✑ Create container1 and share1.
✑ Use the principle of least privilege.
✑ Create an Azure AD security group named Group4.
✑ Back up the Azure file shares and virtual machines by using Azure Backup.
✑ Trigger an alert if VM1 or VM2 has less than 20 GB of free space on volume C.
✑ Enable User1 to create Azure policy definitions and User2 to assign Azure policies to RG1.
✑ Create an internal Basic Azure Load Balancer named LB1 and connect the load balancer to VNET1/Subnet1
✑ Enable flow logging for IP traffic from VM5 and retain the flow logs for a period of eight months.
✑ Whenever possible, grant Group4 Azure role-based access control (Azure RBAC) read-only permissions to the Azure file shares.
You need to add VM1 and VM2 to the backend poo! of LB1.
What should you do first?
Create a new NSG and associate the NSG to VNET1/Subnet1.
Connect VM2 to VNET1/Subnet1.
Redeploy VM1 and VM2 to the same availability zone.
Redeploy VM1 and VM2 to the same availability set.
Understanding Azure Load Balancers
Basic Load Balancer: A basic load balancer is used for basic traffic distribution. This type of load balancer does not require the virtual machines to be in the same availability set or availability zone.
Backend Pool: The group of virtual machines to which the load balancer distributes traffic.
Availability Sets: A logical grouping of VMs that protects your application from planned and unplanned maintenance.
Availability Zones: Physically separate locations within an Azure region that provide high availability and fault tolerance for applications.
Virtual Machine Placement: Virtual machines must be in the same region as the load balancer.
Analyzing the Situation
LB1: An internal Basic Azure Load Balancer, connected to VNET1/Subnet1.
VM1: In West US, connected to VNET1/Subnet1.
VM2: In West US, connected to VNET1/Subnet2.
Determining the First Step
Let’s evaluate the options:
“Create a new NSG and associate the NSG to VNET1/Subnet1.”
Analysis: NSGs are related to security, and are not required to connect virtual machines to a load balancer’s backend pool. While this may be a step you would take in a production environment, it is not the first step to add VMs to a load balancer, so this option is incorrect.
“Connect VM2 to VNET1/Subnet1.”
Analysis: This is the correct first step. The Basic Load Balancer must have the virtual machines within the same virtual network and subnet. Both virtual machines must be within the same subnet in order to be added to the load balancer.
While a basic load balancer does not have any requirements of using a specific availability set or zone, having a single subnet is required.
“Redeploy VM1 and VM2 to the same availability zone.”
Analysis: A basic load balancer does not have any requirements to have the virtual machines on the same availability zone. Therefore this is not the correct first step. This option is incorrect.
“Redeploy VM1 and VM2 to the same availability set.”
Analysis: A basic load balancer does not have any requirements to have the virtual machines on the same availability set. Therefore this is not the correct first step. This option is incorrect.
The Correct First Step
The correct first step to take is to connect VM2 to VNET1/Subnet1.
Overview
General Overview
Contoso, Ltd. is a consulting company that has a main office in Montreal and branch offices in Seattle and New York.
Environment
Existing Environment
Contoso has an Azure subscription named Sub1 that is linked to an Azure Active Directory (Azure AD) tenant. The network contains an on-premises Active Directory domain that syncs to the Azure AD tenant.
The Azure AD tenant contains the users shown in the following table.
Name Type Role
User1 Member None
User2 Guest None
User3 Member None
User4 Member None
Sub1 contains two resource groups named RG1 and RG2 and the virtual networks shown in the
following table.
Name Subnet Peered with
VNET1 Subnet1, Subnet2 VNET2
VNET2 Subnet1 VNET1, VNET3
VNET3 Subnet1 VNET2
VNET4 Subnet1 None
User1 manages the resources in RG1. User4 manages the resources in RG2.
Sub1 contains virtual machines that run Windows Server 2019 as shown in the following table
Name IP address Location Connected to
VM1 10.0.1.4 West US VNET1/Subnet1
VM2 10.0.2.4 West US VNET1/Subnet2
VM3 172.16.1.4 Central US VNET2/Subnet1
VM4 192.168.1.4 West US VNET3/Subnet1
VM5 10.0.22.4 East US VNET4/Subnet1
No network security groups (NSGs) are associated to the network interfaces or the subnets.
Sub1 contains the storage accounts shown in the following table.
Name Kind Location File share Identity-based
access for file share
storage1 Storage (general purpose v1) West US sharea Azure Active Directory Domain Services (Azure AD DS)
storage2 StorageV2 (general purpose v2) East US shareb, sharec Disabled
storage3 BlobStorage East US 2 Not applicable Not applicable
storage4 FileStorage Central US shared Azure Active Directory Domain Services (Azure AD DS)
Requirements
Planned Changes
Contoso plans to implement the following changes:
✑ Create a blob container named container1 and a file share named share1 that will use the Cool storage tier.
✑ Create a storage account named storage5 and configure storage replication for the Blob service.
✑ Create an NSG named NSG1 that will have the custom inbound security rules shown in the following table.
Priority Port Protocol Source Destination Action
500 3389 TCP 10.0.2.0/24 Any Deny
1000 Any ICMP Any Virtual Network Allow
Associate NSG1 to the network interface of VM1.
Create an NSG named NSG2 that will have the custom outbound security rules shown in the following table.
Priority Port Protocol Source Destination Action
200 3389 TCP 10.0.0.0/16 Virtual Network Deny
400 Any ICMP 10.0.2.0/24 10.0.1.0/24 Allow
Associate NSG2 to VNET1/Subnet2.
Technical Requirements
Contoso must meet the following technical requirements:
✑ Create container1 and share1.
✑ Use the principle of least privilege.
✑ Create an Azure AD security group named Group4.
✑ Back up the Azure file shares and virtual machines by using Azure Backup.
✑ Trigger an alert if VM1 or VM2 has less than 20 GB of free space on volume C.
✑ Enable User1 to create Azure policy definitions and User2 to assign Azure policies to RG1.
✑ Create an internal Basic Azure Load Balancer named LB1 and connect the load balancer to VNET1/Subnet1
✑ Enable flow logging for IP traffic from VM5 and retain the flow logs for a period of eight months.
✑ Whenever possible, grant Group4 Azure role-based access control (Azure RBAC) read-only permissions to the Azure file shares.
You need to identify which storage account to use for the flow logging of IP traffic from VM5. The solution must meet the retention requirements.
Which storage account should you identify?
storage4
storage1
storage2
storage3
Understanding Azure Network Watcher Flow Logs
NSG Flow Logs: Capture IP traffic information for a network security group (NSG).
Storage Account: NSG flow logs are stored in an Azure Storage account.
Retention Policy: The storage account must be able to retain logs for a specific period (8 months).
NSG and Storage Account Location: The NSG and storage account do not need to be in the same location, as there is no technical constraint to store the NSG flow logs outside of the region where the network security group has been created.
Analyzing the Requirements
Flow Logs for VM5: We need to enable flow logging for the network traffic of VM5.
Retention: The flow logs must be retained for eight months.
Storage Account: We need to identify a suitable storage account.
Analyzing the Storage Accounts
storage1:
Kind: Storage (general purpose v1)
Location: West US
Analysis: General purpose v1 storage accounts can be used for storing NSG flow logs, but are a legacy type of storage account.
storage2:
Kind: StorageV2 (general purpose v2)
Location: East US
Analysis: General purpose v2 storage accounts can be used for storing NSG flow logs, and are a newer type of storage account, and are the preferred storage account type.
storage3:
Kind: BlobStorage
Location: East US 2
Analysis: Blob storage accounts can be used for storing NSG flow logs.
storage4:
Kind: FileStorage
Location: Central US
Analysis: File storage accounts are not designed to store flow logs, and therefore is incorrect.
Determining the Correct Storage Account
The requirements do not state any other limitations to the storage account, other than being able to store NSG flow logs. The correct type of storage account will be able to store NSG flow logs.
storage1, storage2, and storage3 are all technically valid options.
storage4 is not a valid option.
The Best Option
While any of storage1, storage2 and storage3 would meet the technical requirements, storage2 is the best option, as it is a general purpose v2 storage account, and is a modern type of storage account.
Answer:
storage2
