HOTSPOT

You have an Azure subscription named Subscription1.

In Subscription1, you create an Azure file share named share1.

You create a shared access signature (SAS) named SAS1 as shown in the following exhibit.

To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Reveal Solution Hide Solution

Correct Answer:

HOTSPOT

You have an Azure subscription named Subscription1.

In Subscription1, you create an Azure file share named share1.

You create a shared access signature (SAS) named SAS1 as shown in the following exhibit.

To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Reveal Solution Hide Solution

Correct Answer:

HOTSPOT

You have an Azure subscription.

You plan to create a role definition to meet the following requirements:

• Users must be able to view the configuration data of a storage account.

• Users must be able to perform all actions on a virtual network.

• The solution must use the principle of least privilege.

What should you include in the role definition for each requirement? To answer, select the appropriate options in the answer area.

Reveal Solution Hide Solution

Correct Answer:

Explanation:

Perform all actions on a virtual network:

“Microsoft.Network/virtualNetworks/*”

View the configuration data of a storage account:

“Microsoft.Storage/StorageAccounts/read”

To perform all actions on a virtual network, you need to use the wildcard () character in the action string, which grants access to all actions that match the string. The action string for virtual networks is "Microsoft.Network/virtualNetworks/". To view the configuration data of a storage account, you need to use the read action substring in the action string, which enables read actions (GET). The action string for storage accounts is “Microsoft.Storage/StorageAccounts/read”.

Reference:

https://learn.microsoft.com/en-us/azure/role-based-access-control/role-definitions

https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

HOTSPOT

You have an Azure subscription that contains the users shown in the following table.

The groups are configured as shown in the following table.

For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Reveal Solution Hide Solution

Correct Answer:

Explanation:

https://learn.microsoft.com/en-us/azure/active-directory/roles/groups-concept#how-are-role-assignable-groups-protected

"Group nesting isn’t supported. A group can’t be added as a member of a role-assignable group."

For the second question:

https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/how-to-manage-groups#add-or-remove-a-group-from-another-group

"We currently don’t support:

…

Adding Microsoft 365 groups to Security groups or other Microsoft 365 groups."

For the third question, although it appears truncated in the screenshot (ending with "for…") there is a reference about Microsoft 365 groups support for roles assignment here:

https://learn.microsoft.com/en-us/azure/active-directory/roles/groups-concept#how-role-assignments-to-groups-work

"To assign a role to a group, you must create a new security or Microsoft 365 group with the isAssignableToRole property set to true."

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have an Azure subscription that contains 10 virtual networks. The virtual networks are hosted in separate resource groups.

Another administrator plans to create several network security groups (NSGs) in the subscription.

You need to ensure that when an NSG is created, it automatically blocks TCP port 8080 between the virtual networks.

Solution: You create a resource lock, and then you assign the lock to the subscription.

Does this meet the goal?

Reveal Solution Hide Solution

HOTSPOT

You have an Azure subscription.

You plan to use Azure Resource Manager templates to deploy 50 Azure virtual machines that will be part of the same availability set.

You need to ensure that as many virtual machines as possible are available if the fabric fails or during servicing.

How should you configure the template? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Reveal Solution Hide Solution

Correct Answer:

Explanation:

Box 1 = max value

Box 2 = 20

Explanation

Use max for platformFaultDomainCount

2 or 3 is max value, depending on which region you are in.

Use 20 for platformUpdateDomainCount

Increasing the update domain (platformUpdateDomainCount) helps with capacity and availability planning when the platform reboots nodes. A higher number for the pool (20 is max) means that fewer of their nodes in any given availability set would be rebooted at once.

Reference:

https://www.itprotoday.com/microsoft-azure/check-if-azure-region-supports-2-or-3-fault-domains-managed-disks

https://github.com/Azure/acs-engine/issues/1030

HOTSPOT

You have an Azure subscription that contains a storage account named storage1.

You need to configure a shared access signature (SAS) to ensure that users can only download blobs securely by name.

Which two settings should you configure? To answer, select the appropriate settings in the answer area. NOTE: Each correct answer is worth one point.

Reveal Solution Hide Solution

Correct Answer:

Explanation:

Allowed resources types: Objects (access by name)

Allowed Permissions: Read (you need download) and List (you need to see the object to read it)

You have an Azure subscription that contains a storage account named storage1. The storage 1 account contains a container named container! You need to configure access to container 1.

The solution must meet the following requirements:

• Only allow read access

• Allow both HTTP and HTTPS protocols.

• Apply access permissions to all the content in the container

What should you use?

Reveal Solution Hide Solution

You have an Azure subscription that contains.

The storage accounts shown in the following table.

You deploy a web app named Appl to the West US Azure region.

You need to back up Appl. The solution must minimize costs.

Which storage account should you use as the target for the backup?

Reveal Solution Hide Solution

HOTSPOT

You plan to create an Azure Storage account in the Azure region of East US 2.

You need to create a storage account that meets the following requirements:

✑ Replicates synchronously

✑ Remains available if a single data center in the region fails

How should you configure the storage account? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Reveal Solution Hide Solution

Correct Answer:

Explanation:

Box 1: Zone-redundant storage (ZRS)

Zone-redundant storage (ZRS) replicates your data synchronously across three storage clusters in a single region.

LRS would not remain available if a data center in the region fails GRS and RA GRS use asynchronous replication.

Box 2: StorageV2 (general purpose V2)

ZRS only support GPv2.

Reference:

https://docs.microsoft.com/en-us/azure/storage/common/storage-redundancy

https://docs.microsoft.com/en-us/azure/storage/common/storage-redundancy-zrs