Q001 - Question
You plan group-based licensing. Licensed groups contain 1,200 unique members. The tenant has 1,000 licenses for the product. You want to meet licensing requirements. What should you do?
Domain: Manage Azure identities and governance (20–25%) Type: Single choice
- A. Obtain at least 200 more licenses.
- B. Keep 1,000 licenses because each group consumes one license.
- C. Set usage location on the groups.
- D. Move the members to Microsoft Entra ID Free.
A is correct.
Explanation: For groups assigned a license, you need at least one license for each unique member. 1,200 unique members require at least 1,200 licenses.
B is incorrect: Licenses are counted per unique member, not per group.
C is incorrect: Usage location is a user property and doesn't add licenses.
D is incorrect: Moving users doesn't provide product licenses.
Q002 - Question
A project team must create and manage all resource types in one resource group. The team must not grant access to others or receive access to other resource groups. Which role assignment meets this requirement?
Domain: Manage Azure identities and governance (20–25%) Type: Single choice
- A. Owner at the resource group scope
- B. Contributor at the resource group scope
- C. Contributor at the subscription scope
- D. User Access Administrator at the resource group scope
B is correct.
Explanation: Contributor can create and manage all types of Azure resources but can't grant access to others. Assigning it at the resource group scope limits access to that group.
A is incorrect: Owner includes the right to delegate access.
C is incorrect: Subscription scope is inherited by all resource groups.
D is incorrect: This role manages access rather than resources.
Q003 - Question
A user has Office 365 Enterprise E1 assigned directly. The user joins a group that has Office 365 Enterprise E3 assigned. Group licensing reports a conflicting service plans error. Which action resolves the error?
Domain: Manage Azure identities and governance (20–25%) Type: Single choice
- A. Wait for Microsoft Entra ID to resolve the conflict automatically.
- B. Select Reprocess on the group without changing any assignment.
- C. Delete the group that has the E3 license.
- D. Remove the redundant direct E1 license, or disable the overlapping plans in the group's E3 assignment.
D is correct.
Explanation: The administrator decides how to resolve conflicting licenses. You can remove the redundant E1 license or disable overlapping plans in the E3 assignment.
A is incorrect: Microsoft Entra ID doesn't resolve license conflicts automatically.
B is incorrect: Reprocessing doesn't remove the conflict.
C is incorrect: A licensed group can't be deleted until its licenses are removed.
Q004 - Question
You will assign a policy with a deny effect to a production subscription. You must view compliance results first without blocking operations or changing the definition. What should you configure?
Domain: Manage Azure identities and governance (20–25%) Type: Single choice
- A. Set the policy definition effect to disabled.
- B. Assign the policy at the tenant root group.
- C. Delete the assignment after the first scan.
- D. Set enforcementMode to DoNotEnforce on the assignment.
D is correct.
Explanation: With enforcementMode set to DoNotEnforce, evaluation still runs but the policy effect isn't enforced. You can review compliance results before changing the mode to Enabled.
A is incorrect: The disabled effect prevents evaluation from happening at all.
B is incorrect: A wider scope increases the impact.
C is incorrect: Deleting the assignment removes the evaluation results.
Q005 - Question
An organization has 12 production subscriptions. It must restrict VM locations to one region. Subscription owners must not be able to override the restriction. Where should you assign the policy?
Domain: Manage Azure identities and governance (20–25%) Type: Single choice
- A. On one resource group in each subscription
- B. On a Reader role assignment for each owner
- C. On a management group that contains the subscriptions
- D. On one subscription, then tag the others
C is correct.
Explanation: Subscriptions in a management group inherit its policy. A policy applied there is inherited by all subscriptions, and the resource or subscription owner can't override it.
A is incorrect: Resource group assignments don't cover each whole subscription.
B is incorrect: A role assignment doesn't enforce VM locations.
D is incorrect: Tags don't apply a policy to other subscriptions.
Q006 - Question
A tenant must keep a Marketing security group current automatically. Any user whose Department attribute equals Marketing must be added or removed without manual updates. Which configuration meets this requirement?
Domain: Manage Azure identities and governance (20–25%) Type: Single choice
- A. Assigned membership type, with the group owner updating members.
- B. Dynamic Device membership type for the Marketing users.
- C. Dynamic User membership type, with a Microsoft Entra ID P1 license.
- D. Microsoft 365 group with Assigned membership type.
C is correct.
Explanation: Dynamic User membership adds and removes users based on rules that evaluate attributes such as department. Dynamic membership requires a Microsoft Entra ID P1 license.
A is incorrect: Assigned membership is maintained manually.
B is incorrect: Dynamic Device rules evaluate device attributes, not user attributes.
D is incorrect: Assigned membership is manual.
Q007 - Question
Employees use personal Android phones to read organizational email. Access must require an Intune compliance policy through Conditional Access. Users must not sign in with an organizational account to the device. Which device identity type fits?
Domain: Manage Azure identities and governance (20–25%) Type: Single choice
- A. Microsoft Entra registered
- B. Microsoft Entra joined
- C. Microsoft Entra hybrid joined
- D. Active Directory domain joined
A is correct.
Explanation: Microsoft Entra registered devices support BYOD and mobile devices, including Android. They don't require an organizational account to sign in to the device. Conditional Access applies when enrolled in Intune.
B is incorrect: Joined devices require an organizational account to sign in.
C is incorrect: Hybrid joined devices must be joined to on-premises Active Directory.
D is incorrect: Domain join doesn't fit personal phones.
Q008 - Question
You configure self-service password reset authentication methods. Which two methods are not recommended, either because fraudulent messages are possible or because answers might be known to other people? Select two.
Domain: Manage Azure identities and governance (20–25%) Type: Multiple choice
- A. Mobile app notification
- B. Mobile phone
- C. Email
- D. Security questions
B and D are correct.
Explanation: The mobile phone method isn't recommended because fraudulent SMS messages are possible. Security questions are the least recommended method because others might know the answers. Use them only with another method.
A is incorrect: Mobile app notification or code is recommended as the primary method.
C is incorrect: Email is suggested to support users without mobile devices.
Q009 - Question
Contoso has three Azure subscriptions. The same employees, groups, and applications must receive permissions in all three subscriptions. Which configuration meets this requirement?
Domain: Manage Azure identities and governance (20–25%) Type: Single choice
- A. Create a separate Microsoft Entra tenant for each subscription.
- B. Associate all three subscriptions with the same Microsoft Entra tenant.
- C. Associate each subscription with two Microsoft Entra tenants.
- D. Place each subscription inside a different resource group.
B is correct.
Explanation: A subscription is associated with exactly one Microsoft Entra tenant, and one tenant can serve multiple subscriptions. The same users, groups, and applications can then receive permissions in all three.
A is incorrect: Separate tenants create separate sets of identities.
C is incorrect: A subscription can't be associated with two tenants.
D is incorrect: Resource groups contain resources, not subscriptions.
Q010 - Question
An app must reach Azure SQL Database by using a private IP address from your virtual network. The public connection must be removed. What should you configure?
Domain: Implement and manage virtual networking (15–20%) Type: Single choice
- A. A virtual network service endpoint
- B. A service endpoint policy
- C. A private endpoint by using Azure Private Link
- D. A public endpoint with an NSG outbound rule
C is correct.
Explanation: Azure Private Link enables you to access Azure PaaS Services over a Private Endpoint in your virtual network, replacing the resource's public endpoint with a private network interface.
A is incorrect: Virtual network service endpoints secure access to an Azure service's public endpoint, but the service itself still uses a public IP.
B is incorrect: Service endpoint policies allow you to filter virtual network traffic to specific Azure resources over service endpoints, but they do not remove the public endpoint.
D is incorrect: A public endpoint with an NSG outbound rule still leaves the resource exposed to the internet via its public IP address.
Q011 - Question
Virtual network A is peered with B, and B is peered with C. A has no peering with C. Resources in A must reach resources in C. What should you do?
Domain: Implement and manage virtual networking (15–20%) Type: Single choice
- A. Nothing. Peering through B is transitive.
- B. Extend the address space of virtual network B.
- C. Change both peerings from regional to global.
- D. Peer A with C, or route through a network virtual appliance in B by using user-defined routes.
D is correct.
Explanation: Virtual network peering is nontransitive. To enable communication between virtual networks A and C, you must either peer them directly or configure user-defined routes (UDRs) to point to a network virtual appliance (NVA) in virtual network B (service chaining).
A is incorrect: Virtual network peering is nontransitive, meaning traffic does not automatically route through an intermediate peered network.
B is incorrect: Extending the address space of virtual network B does not enable transitive routing between A and C.
C is incorrect: Changing the peering type from regional to global does not change the nontransitive nature of virtual network peering.
Q012 - Question
You are planning IP addressing for a new Azure virtual network. Which of the following resources should be assigned a static IP address?
Domain: Implement and manage virtual networking (15–20%) Type: Single choice
- A. A virtual machine that acts as a Domain Controller
- B. A virtual machine used for temporary batch processing
- C. A virtual machine in a scale set
- D. A virtual machine used for testing
A is correct.
Explanation: Static IP addresses do not change and are best for role-based virtual machines such as Domain Controllers and DNS servers.
B is incorrect: Temporary batch processing virtual machines do not typically require static IP addresses.
C is incorrect: Virtual Machine Scale Set instances generally use dynamic IP addresses to scale efficiently.
D is incorrect: Testing environments typically use dynamic IP addresses unless a specific static IP scenario is being tested.
Q013 - Question
A virtual machine is in a subnet with a network security group (NSG) that allows inbound port 443. The virtual machine's network interface has its own NSG with no allow rule. Inbound traffic fails. Why?
Domain: Implement and manage virtual networking (15–20%) Type: Single choice
- A. The subnet NSG overrides the network interface NSG.
- B. Outbound rules are evaluated before inbound rules.
- C. The network interface NSG also needs an allow rule.
- D. Default security rules were removed from the network interface NSG.
C is correct.
Explanation: Each network security group (NSG) is evaluated independently. If you have a subnet or network interface in your NSG, you must define an allow rule at each level.
A is incorrect: Azure evaluates both NSGs independently; the subnet NSG does not override the network interface NSG.
B is incorrect: For inbound traffic, Azure first processes NSG rules for associated subnets and then associated network interfaces.
D is incorrect: You cannot remove the default security rules from an NSG.
Q014 - Question
Engineers need native RDP clients and IP-based connections from a hub Bastion to spoke virtual machines. Session recording isn't required. Which is the minimum SKU?
Domain: Implement and manage virtual networking (15–20%) Type: Single choice
- A. Developer
- B. Basic
- C. Standard
- D. Premium
C is correct.
Explanation: The Standard SKU adds native client support and IP-based connections, which are required for this scenario.
A is incorrect: The Developer SKU does not support native clients or IP-based connections.
B is incorrect: The Basic SKU provides browser-based access only and does not support native clients.
D is incorrect: The Premium SKU includes session recording, which is not required for this scenario, making Standard the minimum SKU.
Q015 - Question
You must map the zone apex of wideworldimports.com to a load balancer public IP address resource. The IP address might change. Which record should you create?
Domain: Implement and manage virtual networking (15–20%) Type: Single choice
- A. An A record that contains the current IP address
- B. An A alias record that targets the public IP resource
- C. A CNAME record at the zone apex for the load balancer
- D. A TXT record that contains the load balancer name
B is correct.
Explanation: Azure alias records enable a zone apex domain to reference other Azure resources, such as a public IP resource. Alias records ensure that changes to the target resource's IP address are automatically applied to the DNS zone.
A is incorrect: An A record with a static IP address can become a dangling DNS record if the underlying IP address of the load balancer changes.
C is incorrect: CNAME records are not supported at the zone apex level.
D is incorrect: A TXT record is used to associate text strings with a domain name, not to resolve a domain name to an IP address.
Q016 - Question
Two virtual networks are already peered. You must change the address range of one network. What should you do?
Domain: Implement and manage virtual networking (15–20%) Type: Single choice
- A. Change the address space while the peering stays connected.
- B. Delete the peering, update the address space, and re-create the peering.
- C. Enable gateway transit on both virtual networks.
- D. Configure a Private DNS zone for both networks.
B is correct.
Explanation: If you want to change a virtual network's address range, you need to delete the peering first, update the address space, and then set up the peering again.
A is incorrect: Peering creation fails if address ranges overlap, and you cannot change the address space while the peering is active.
C is incorrect: Gateway transit allows peered virtual networks to share a gateway, but it does not allow you to modify the address space of a peered network.
D is incorrect: Configuring a Private DNS zone provides name resolution but does not allow you to bypass the address space modification restrictions.
Q017 - Question
You must route traffic to on-premises web servers, block SQL injection, terminate TLS, and keep session affinity. Which Azure service meets these needs?
Domain: Implement and manage virtual networking (15–20%) Type: Single choice
- A. Azure Application Gateway
- B. Azure Load Balancer
- C. Azure Traffic Manager
- D. Azure Network Watcher
A is correct.
Explanation: Azure Application Gateway provides a web application firewall to block SQL injection, supports TLS termination, maintains session affinity, and can route traffic to on-premises servers.
B is incorrect: Azure Load Balancer operates at Layer 4 and does not include a web application firewall or TLS termination.
C is incorrect: Azure Traffic Manager is a DNS-based traffic load balancer and does not provide a web application firewall or TLS termination.
D is incorrect: Azure Network Watcher provides tools to monitor and diagnose network performance, not to route traffic or provide a firewall.
Q018 - Question
A route table has routes for 10.0.0.0/16 and 10.0.0.0/24. A packet is sent to 10.0.0.2. Which route does Azure select?
Domain: Implement and manage virtual networking (15–20%) Type: Single choice
- A. 10.0.0.0/16, because it covers more addresses
- B. Neither route, because the prefixes overlap
- C. The route that was created first
- D. 10.0.0.0/24, because it has the longest prefix match
D is correct.
Explanation: If multiple routes are available in a route table, Azure uses the route with the longest prefix match. The 10.0.0.0/24 prefix is more specific than 10.0.0.0/16.
A is incorrect: Azure selects the route with the longest prefix match, not the one that covers more addresses.
B is incorrect: Overlapping prefixes are allowed, and Azure resolves them by selecting the longest prefix match.
C is incorrect: Route selection is based on prefix length and route type priority, not creation order.
Q019 - Question
You need to centralize your organization's file shares in Azure Files while maintaining the performance and compatibility of an on-premises Windows file server. Which service should you configure?
Domain: Implement and manage storage (15–20%) Type: Single choice
- A. Azure File Sync
- B. Azure Storage Explorer
- C. Azure Data Box Disk
- D. AzCopy
A is correct.
Explanation: Azure File Sync enables you to cache Azure Files shares on an on-premises Windows Server, keeping local performance and compatibility.
B is incorrect: Storage Explorer is a standalone app to manage storage data.
C is incorrect: Data Box Disk is for offline data transfer.
D is incorrect: AzCopy is a command-line tool for copying data.
Q020 - Question
External developers need limited blob access. You must revoke access without regenerating storage account keys. What should you configure?
Domain: Implement and manage storage (15–20%) Type: Single choice
- A. Share the primary account key
- B. Make the container public
- C. Issue an ad hoc SAS with a long expiry
- D. A service-level SAS that references a stored access policy
D is correct.
Explanation: Stored access policies let you revoke permissions without regenerating account keys.
A is incorrect: Account keys give broad access.
B is incorrect: Public containers allow anonymous read access.
C is incorrect: Without a policy, use near-term expiry instead.
Q021 - Question
You need to automatically move blob data that has not been accessed for 30 days to the Cool tier. What should you configure?
Domain: Implement and manage storage (15–20%) Type: Single choice
- A. Blob lifecycle management rules
- B. Object replication policies
- C. Blob access tiers at the account level
- D. Azure File Sync cloud tiering
A is correct.
Explanation: Azure Blob Storage lifecycle management policy rules can automatically transition blobs to a cooler storage tier based on access or modification time.
B is incorrect: Object replication copies blobs between containers asynchronously.
C is incorrect: Account-level access tiers set the default tier, but do not automatically move aging data based on access time.
D is incorrect: Azure File Sync is for Azure Files, not Blob Storage.
Q022 - Question
You configure object replication between two storage accounts in different regions. Which setting must be enabled on both accounts?
Domain: Implement and manage storage (15–20%) Type: Single choice
- A. Blob versioning
- B. Blob snapshots
- C. Anonymous blob access
- D. Archive tier
A is correct.
Explanation: Object replication requires blob versioning on both source and destination accounts.
B is incorrect: Snapshots aren't replicated.
C is incorrect: Anonymous access isn't a stated requirement.
D is incorrect: Supported tiers are Hot, Cool, or Cold.
Q023 - Question
Compliance records are rarely read, must stay stored for at least 180 days, and can tolerate several hours of retrieval latency. Which tier minimizes storage cost?
Domain: Implement and manage storage (15–20%) Type: Single choice
- A. Hot
- B. Archive
- C. Cool
- D. Cold
B is correct.
Explanation: Archive is the lowest-cost tier for data kept 180 days that tolerates hours of retrieval.
A is incorrect: Hot costs most to store.
C is incorrect: Cool costs more to store.
D is incorrect: Cold costs more to store.
Q024 - Question
You plan to lift and shift an on-premises application to Azure. The application expects to use native file system APIs and share data with other applications running in Azure. Which storage service should you use?
Domain: Implement and manage storage (15–20%) Type: Single choice
- A. Azure Files
- B. Azure Blob Storage
- C. Azure Queue Storage
- D. Azure Table Storage
A is correct.
Explanation: Azure Files is ideal to lift and shift an application to the cloud that already uses the native file system APIs.
B is incorrect: Blob Storage is ideal for streaming and random-access scenarios, not native file system APIs.
C is incorrect: Queue Storage is for messages.
D is incorrect: Table Storage is for structured NoSQL data.
Q025 - Question
A Standard general-purpose v2 storage account hosts a database workload that now needs consistent low-latency SSD performance. What should you do?
Domain: Implement and manage storage (15–20%) Type: Single choice
- A. Convert the account to Premium in the Azure portal
- B. Upgrade the account to General-purpose v1
- C. Enable GZRS on the existing account
- D. Create a Premium storage account and copy the data
D is correct.
Explanation: You can't convert Standard to Premium. Create a new account and copy data.
A is incorrect: Standard-to-Premium conversion isn't supported.
B is incorrect: GPv1 is a legacy type.
C is incorrect: Redundancy doesn't change the performance type.
Q026 - Question
A storage account must survive an availability zone failure and a regional outage, and allow reads from the secondary region during the outage. Which replication option meets this requirement?
Domain: Implement and manage storage (15–20%) Type: Single choice
- A. RA-GZRS
- B. ZRS
- C. GZRS
- D. LRS
A is correct.
Explanation: RA-GZRS uses three zones, a secondary region, and read access to the secondary.
B is incorrect: ZRS stays in one region.
C is incorrect: GZRS lacks secondary read access.
D is incorrect: LRS can lose all replicas.
Q027 - Question
You deploy an App Service update. You must validate it first and restore the previous version quickly if problems appear. What should you use?
Domain: Deploy and manage Azure compute resources (20–25%) Type: Single choice
- A. Scheduled autoscale rules
- B. A custom domain name
- C. A staging deployment slot with swap
- D. Backup and restore of the production slot
C is correct.
Explanation: You can validate changes to your app in a staging deployment slot before swapping with the production slot. If the changes aren't as expected, you can perform the same swap immediately to return to your last known good site.
A is incorrect: Scheduled autoscale rules adjust the number of instances based on time, not deployment versions.
B is incorrect: A custom domain name changes the web address, not the deployment version.
D is incorrect: Restoring a backup replaces all content on the site and is not as quick or seamless as a slot swap.
Q028 - Question
A container app must send 25 percent of requests to a new v2 revision and 75 percent to the current revision. What must you configure first?
Domain: Deploy and manage Azure compute resources (20–25%) Type: Single choice
- A. A scale rule with 10,000 concurrent requests
- B. A user-assigned managed identity for the app
- C. Multiple revision mode
- D. A private endpoint on PESubnet
C is correct.
Explanation: To configure traffic splitting between two labeled revisions, you must first set the revision mode to multiple.
A is incorrect: A scale rule with concurrent requests triggers autoscaling, not traffic splitting between revisions.
B is incorrect: A user-assigned managed identity is used for authentication, not traffic splitting.
D is incorrect: A private endpoint provides a secure connection to resources, not traffic splitting between revisions.
Q029 - Question
You create a scale set in a region where fewer than five fault domains are available. Which setting lets the deployment complete?
Domain: Deploy and manage Azure compute resources (20–25%) Type: Single choice
- A. Max spreading
- B. Fixed spreading
- C. Uniform orchestration mode
- D. Flexible orchestration mode
A is correct.
Explanation: In the case where fewer than five fault domains are available, a scale set using Max spreading completes, while a scale set using Fixed spreading fails.
B is incorrect: Fixed spreading fails when fewer than five fault domains are available.
C is incorrect: Uniform orchestration mode dictates that all VM instances are created from the same base image, not how they are spread across fault domains.
D is incorrect: Flexible orchestration mode allows VMs to use different images or sizes, but is not a spreading algorithm.
Q030 - Question
You plan to back up an Azure App Service app to an Azure storage account. The target storage account has a firewall enabled. What is the result?
Domain: Deploy and manage Azure compute resources (20–25%) Type: Single choice
- A. Backups bypass the firewall automatically.
- B. Only the production slot is backed up.
- C. Backups have no size limit.
- D. You can't use that storage account as the backup destination.
D is correct.
Explanation: If your storage account is enabled with a firewall, you can't use the storage account as the destination for your backups.
A is incorrect: Backups do not automatically bypass the storage account firewall.
B is incorrect: The limitation of backing up only the production slot applies to the Basic tier, not to storage accounts with firewalls.
C is incorrect: Backups can hold up to 10 GB of app and database content.
Q031 - Question
A production VM must run continuously for at least three years. Finance needs predictable compute costs. Which compute payment option should you choose?
Domain: Deploy and manage Azure compute resources (20–25%) Type: Single choice
- A. Pay as you go
- B. Reserved Virtual Machine Instances
- C. Auto-shutdown on a daily schedule
- D. Stop and deallocate the VM every night
B is correct.
Explanation: The Reserved Virtual Machine Instances option is an advance purchase for one or three years that provides budget predictability.
A is incorrect: Pay as you go has no long-term commitment or upfront payments.
C is incorrect: Auto-shutdown is used to save costs by ensuring VMs are not running when not needed, but does not provide predictable compute costs for continuously running VMs.
D is incorrect: Stopping and deallocating the VM releases the hardware but does not provide predictable compute costs for continuously running VMs.
Q032 - Question
An App Service plan uses autoscale with only a scale-out rule. What should you add to avoid unnecessary costs when load drops?
Domain: Deploy and manage Azure compute resources (20–25%) Type: Single choice
- A. A scale-in rule
- B. A higher maximum instance count
- C. A custom domain name
- D. A staging deployment slot
A is correct.
Explanation: Always use a scale-out and scale-in rule combination. If you don't set a scale-in rule, you can experience unnecessary and extensive costs when the load decreases.
B is incorrect: A higher maximum instance count limits the total possible hourly cost but does not scale in when load drops.
C is incorrect: A custom domain name maps a domain to your app and does not affect scaling.
D is incorrect: A staging deployment slot is used to validate app changes, not to scale instances.
Q033 - Question
You need to run an App Service application that requires network isolation and the maximum scale-out capabilities. Which pricing tier should you choose?
Domain: Deploy and manage Azure compute resources (20–25%) Type: Single choice
- A. Free
- B. Standard
- C. PremiumV3
- D. IsolatedV2
D is correct.
Explanation: The Isolated and IsolatedV2 tiers run dedicated Azure VMs on dedicated Azure virtual networks, providing network isolation and the maximum scale-out capabilities.
A is incorrect: The Free tier runs on shared resources and does not provide network isolation or scale-out.
B is incorrect: The Standard tier runs on dedicated VMs but does not provide network isolation.
C is incorrect: The PremiumV3 tier provides enhanced scale and performance but does not provide network isolation.
Q034 - Question
You resize a running production VM to a size that is available in its current hardware cluster. What should you expect?
Domain: Deploy and manage Azure compute resources (20–25%) Type: Single choice
- A. The VM stays online with no interruption.
- B. The VM reboots automatically, which can cause a temporary outage.
- C. You must delete and recreate the VM.
- D. Only the attached data disks are resized.
B is correct.
Explanation: Changing a running VM size automatically reboots the machine to complete the request, which can cause a temporary outage.
A is incorrect: The VM does not stay online; it reboots automatically.
C is incorrect: You do not need to delete and recreate the VM if the new size is available in the current hardware cluster.
D is incorrect: Resizing changes the VM's compute size, not the attached data disks.
Q035 - Question
VM insights is enabled on a Linux VM. You now need Syslog events available for KQL queries in Log Analytics. What should you do?
Domain: Monitor and maintain Azure resources (10–15%) Type: Single choice
- A. Enable boot diagnostics on the VM
- B. Plot Syslog data in Metrics Explorer
- C. Enable recommended alert rules on the VM
- D. Create a separate DCR with the Linux Syslog data source
D is correct.
Explanation: The VM insights DCR collects predefined counters. Create a separate DCR for Syslog.
A is incorrect: Boot diagnostics are host logs for boot issues.
B is incorrect: Metrics Explorer shows metrics, not Syslog events.
C is incorrect: Alert rules notify; they don't collect logs.
Q036 - Question
Your Azure Backup vaults span several subscriptions and regions. You need one aggregated view of backup operational activities. Which tool should you use?
Domain: Monitor and maintain Azure resources (10–15%) Type: Single choice
- A. The built-in job monitoring in each vault
- B. Azure Service Health
- C. Backup Explorer
- D. Azure Advisor
C is correct.
Explanation: Backup Explorer is an Azure Monitor workbook that aggregates backup activity across tenants, subscriptions, and vaults.
A is incorrect: Vault job monitoring is scoped to one vault.
B is incorrect: Service Health reports Azure service events.
D is incorrect: Advisor provides recommendations.
Q037 - Question
A VM encrypted with Azure Disk Encryption has a corrupted file. You need to recover only that file from Azure Backup. Which approach is supported?
Domain: Monitor and maintain Azure resources (10–15%) Type: Single choice
- A. Restore the entire VM, then copy the file manually
- B. Run a file-level restore from the recovery point
- C. Use the Replace existing restore option
- D. Use Cross Zonal Restore to restore only the file
A is correct.
Explanation: Encrypted VMs require a full VM restore. Then you copy the file or folder manually.
B is incorrect: File-level restores aren't supported for encrypted VMs.
C is incorrect: Replace existing isn't available for encrypted VMs.
D is incorrect: Cross Zonal Restore is unsupported for encrypted VMs.
Q038 - Question
You need to monitor the processes running on an Azure virtual machine and map its dependencies with other services. Which Azure Monitor feature should you use?
Domain: Monitor and maintain Azure resources (10–15%) Type: Single choice
- A. VM insights
- B. Metrics Explorer
- C. Boot diagnostics
- D. Azure Service Health
A is correct.
Explanation: VM insights provides a dependency map that displays interconnected components with other VMs and external sources by discovering running process groups and processes.
B is incorrect: Metrics Explorer is used to plot and analyze host metrics, not map dependencies.
C is incorrect: Boot diagnostics are used to troubleshoot VM startup issues.
D is incorrect: Azure Service Health provides information about the health of Azure services and regions.
Q039 - Question
One alert rule covers 20 VMs. Three VMs enter planned maintenance every week. You must stop notifications for only those three VMs. What should you do?
Domain: Monitor and maintain Azure resources (10–15%) Type: Single choice
- A. Disable the shared alert rule during the maintenance window.
- B. Create an alert processing rule that suppresses notifications on a schedule.
- C. Add another action group to the alert rule.
- D. Delete the alert rule and recreate it afterward.
B is correct.
Explanation: A scheduled suppression rule stops notifications for the selected scope only.
A is incorrect: Disabling the rule stops alerts for VMs that aren't in maintenance.
C is incorrect: Another action group adds notifications.
D is incorrect: Deleting the rule removes coverage.
Q040 - Question
You need to configure an alert to trigger a runbook in Azure Automation when a specific metric threshold is met. Which component should you configure to execute the runbook?
Domain: Monitor and maintain Azure resources (10–15%) Type: Single choice
- A. Alert processing rule
- B. Action group
- C. Alert condition
- D. Data collection rule
B is correct.
Explanation: Action groups allow actions to be triggered, such as an Automation Runbook.
A is incorrect: Alert processing rules modify triggered alerts as they are being fired, such as suppressing notifications.
C is incorrect: The alert condition defines when the alert is triggered, not the action taken.
D is incorrect: A data collection rule defines what data to collect and where to send it.
Q041 - Question
You configured Azure Site Recovery for on-premises VMs. You must validate recovery without disrupting live services. What should you do?
Domain: Monitor and maintain Azure resources (10–15%) Type: Single choice
- A. Run a test failover for one VM on an isolated Azure network.
- B. Run a test failover on the production network.
- C. Fail over all protected VMs to Azure.
- D. Run a failback for the protected VMs.
A is correct.
Explanation: A recovery drill on an isolated network tests the configuration without disrupting live services.
B is incorrect: The production network can disrupt live services.
C is incorrect: A full failover moves the live environment.
D is incorrect: Failback happens after a failover.
Q042 - Question
An Azure VM was deleted. You need a basic VM running quickly from a restore point in the same region. Which restore option should you use?
Domain: Monitor and maintain Azure resources (10–15%) Type: Single choice
- A. Replace existing
- B. Cross region restore with Replace existing
- C. Create a new VM
- D. Recover files by mounting a snapshot with iSCSI
C is correct.
Explanation: Create a new VM builds a basic VM from a restore point in the source VM's region.
A is incorrect: Replace existing requires the VM to exist.
B is incorrect: Cross region restore doesn't support Replace existing.
D is incorrect: File recovery restores files, not a VM.
Q043 - Question
Engineers with the Owner role must still read and modify resources in a production resource group. You must prevent accidental deletion of the resource group's resources. Which configuration meets this requirement?
Domain: Manage Azure identities and governance (20–25%) Type: Single choice
- A. Apply a Delete lock to the resource group.
- B. Apply a ReadOnly lock to the resource group.
- C. Assign the Reader role to the engineers.
- D. Rely on Azure RBAC only, because locks apply to users without roles.
A is correct.
Explanation: A Delete lock lets authorized users read and modify resources but not delete them. The lock is inherited by resources in the resource group.
B is incorrect: A ReadOnly lock also blocks updates.
C is incorrect: Reader permissions don't allow modification.
D is incorrect: Locks apply regardless of RBAC permissions, including for owners.
Q044 - Question
You need to determine if a widespread outage is currently affecting Azure services across multiple regions. Which tool should you check first?
Domain: Monitor and maintain Azure resources (10–15%) Type: Single choice
- A. Azure Status
- B. Resource Health
- C. Azure Advisor
- D. Log Analytics
A is correct.
Explanation: Azure Status gives you a global picture of Azure health across all services and regions.
B is incorrect: Resource Health zooms in on individual resources, such as a specific virtual machine.
C is incorrect: Azure Advisor evaluates your Azure resources and makes recommendations to help you improve reliability, security, performance, and cost efficiency.
D is incorrect: Log Analytics is used to write and run queries against data collected by Azure Monitor.
Q045 - Question
A production workload requires complete network isolation for blob access, with no public internet exposure. Which configuration should you use?
Domain: Implement and manage storage (15–20%) Type: Single choice
- A. Service endpoint for a subnet
- B. Custom domain with a CNAME record
- C. Private endpoint in the virtual network
- D. Firewall rule for a public IP range
C is correct.
Explanation: A private endpoint uses a private VNet IP address; traffic stays on the Microsoft backbone.
A is incorrect: Service endpoints keep the public endpoint.
B is incorrect: Custom domains only map names.
D is incorrect: Public IP rules keep public access.
Q046 - Question
A subnet route table has a user-defined route, a BGP route, and a system route for the same address prefix. Which route does Azure use?
Domain: Implement and manage virtual networking (15–20%) Type: Single choice
- A. The user-defined route
- B. The BGP route
- C. The system route
- D. The most recently created route
A is correct.
Explanation: If there are multiple routes with the same address prefix, Azure selects the route based on the type in the following order of priority: User-defined routes, BGP routes, and System routes.
B is incorrect: BGP routes have a lower priority than user-defined routes.
C is incorrect: System routes have the lowest priority among the three types.
D is incorrect: Route selection is based on route type priority, not the order of creation.
Q047 - Question
A two-container group must accept external traffic on port 8080 and forward it to container port 80. What applies to Azure Container Instances?
Domain: Deploy and manage Azure compute resources (20–25%) Type: Single choice
- A. Configure port mapping on the group's public IP address.
- B. Port mapping isn't supported because containers share a port namespace.
- C. Each container receives its own public IP address.
- D. Each container runs on a separate host machine.
B is correct.
Explanation: Port mapping isn't supported because containers in a group share a port namespace.
A is incorrect: Port mapping is not supported in Azure Container Instances.
C is incorrect: Container groups share an external-facing IP address; containers do not receive their own public IP address.
D is incorrect: A container group is a collection of containers that get scheduled on the same host machine.
Q048 - Question
You need to configure Azure Storage encryption for a new storage account. You want to generate and manage the encryption keys in your own Azure Key Vault. Which encryption option should you use?
Domain: Implement and manage storage (15–20%) Type: Single choice
- A. Customer-managed keys
- B. Platform-managed keys
- C. Infrastructure encryption
- D. Client-side encryption
A is correct.
Explanation: Customer-managed keys are created and managed by the customer and stored in a customer-owned Azure Key Vault.
B is incorrect: Platform-managed keys are generated and managed entirely by Azure.
C is incorrect: Infrastructure encryption encrypts data twice at the service and infrastructure levels, but doesn't specify key management in Key Vault.
D is incorrect: Client-side encryption manages keys on-premises or in another secure location before data is sent to Azure.
Q049 - Question
You replicate physical servers to Azure by using Site Recovery. After a failover, you plan the failback. Which approach is supported?
Domain: Monitor and maintain Azure resources (10–15%) Type: Single choice
- A. Fail back directly to the physical servers.
- B. Change the failback RPO to 5 minutes.
- C. Fail back without VMware vCenter or a configuration server.
- D. Fail back to on-premises VMs by using vCenter with a configuration server.
D is correct.
Explanation: Failback needs VMware vCenter with a configuration server and targets virtual machines.
A is incorrect: You can't fail back to physical servers.
B is incorrect: The failback RPO is fixed at 15 minutes.
C is incorrect: vCenter with a configuration server must be available.
Q050 - Question
An existing VM must become a member of an availability set. Which action is the supported way to achieve this?
Domain: Deploy and manage Azure compute resources (20–25%) Type: Single choice
- A. Select the availability set in VM settings while the VM runs
- B. Stop the VM, then add it to the availability set
- C. Assign the VM to an update domain directly
- D. Delete the VM and recreate it in the availability set
D is correct.
Explanation: A virtual machine can only be added to an availability set when the virtual machine is created. To change the availability set for a virtual machine, you need to delete and then recreate the virtual machine.
A is incorrect: You cannot select or change the availability set for a virtual machine while it runs.
B is incorrect: Stopping the VM does not allow you to add it to an availability set.
C is incorrect: You cannot assign a VM to an update domain directly; it is placed in one automatically when added to an availability set.