You have a subnet named Subnet1 that contains Azure virtual machines. A network security group (NSG) named NSG1 is associated to Subnet1. NSG1 only contains the default rules.
You need to create a rule in NSG1 to prevent the hosts on Subnet1 form connecting to the Azure portal. The hosts must be able to connect to other internet hosts.
To what should you set Destination in the rule?

A. Application security group

B. IP Addresses

C. Service Tag

D. Any

You have an Azure subscription named Subscription1 that contains an Azure Log Analytics workspace named Workspace1.
You need to view the error events from a table named Event.
Which query should you run in Workspace1?

A. search in (Event) “error”

B. Event | where EventType is “error”

C. select * from Event where EventType == “error”

D. Get-Event Event | where {$_.EventType == “error”}

You have an Azure virtual machine named VM1.
Azure collects events from VM1.
You are creating an alert rule in Azure Monitor to notify an administrator when an error is logged in the System event log of VM1.
Which target resource should you monitor in the alert rule?

A. virtual machine extension

B. virtual machine

C. metric alert

D. Azure Log Analytics workspace

You have an Azure App Service web app named App1.
You need to collect performance traces for App1.
What should you use?

A. Azure Application Insights Profiler

B. the Activity log

C. the Deployment center

D. the Diagnose and solve problems settings

You have an Azure subscription that contains 100 virtual machines.
You regularly create and delete virtual machines.
You need to identify unattached disks that can be deleted.
What should you do?

A. From Azure Cost Management, view Cost Analysis

B. From Azure Advisor, modify the Advisor configuration

C. From Microsoft Azure Storage Explorer, view the Account Management properties

D. From Azure Cost Management, view Advisor Recommendations

You have an Azure subscription that contains the storage accounts shown in the following table.
 
You deploy a web app named App1 to the West US Azure region.
You need to back up App1. The solution must minimize costs.
Which storage account should you use as the target for the backup?

A. storage1

B. storage2

C. storage3

D. storage4

You have an Azure web app named webapp1.
Users report that they often experience HTTP 500 errors when they connect to webapp1.
You need to provide the developers of webapp1 with real-time access to the connection errors. The solution must provide all the connection error details.
What should you do first?

A. From webapp1, enable Web server logging

B. From Azure Monitor, create a workbook

C. From Azure Monitor, create a Service Health alert

D. From webapp1, turn on Application Logging

HOTSPOT
-
You have an Azure subscription that is linked to an Azure AD tenant. The tenant contains two users named User1 and User2.
The subscription contains the resources shown in the following table.
 
The subscription contains the alert rules shown in the following table.
 
The users perform the following action:
• User1 creates a new virtual disk and attaches the disk to VM1
• User2 creates a new resource tag and assigns the tag to RG1 and VM1
Which alert rules are triggered by each user? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
 

You have an Azure web app named App1.
You need to monitor the availability of App1 by using a multi-step web test.
What should you use in Azure Monitor?

A. Azure Service Health

B. Azure Application Insights

C. the Diagnostic settings

D. metrics

You have an Azure subscription that contains multiple virtual machines in the West US Azure region.
You need to use Traffic Analytics in Azure Network Watcher to monitor virtual machine traffic.
Which two resources should you create? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

A. a Log Analytics workspace

B. an Azure Monitor workbook

C. a storage account

D. a Microsoft Sentinel workspace

E. a Data Collection Rule (DCR) in Azure Monitor

HOTSPOT -
You have an Azure subscription that has diagnostic logging enabled and is configured to send logs to a Log Analytics workspace.
You are investigating a service outage.
You need to view the event time, the event name, and the affected resources.
How should you complete the query? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
 

You have a Recovery Services vault named RSV1. RSV1 has a backup policy that retains instant snapshots for five days and daily backup for 14 days.
RSV1 performs daily backups of VM1. VM1 hosts a static website that was updated eight days ago.
You need to recover VM1 to a point eight days ago. The solution must minimize downtime.
What should you do first?

A. Deallocate VM1.

B. Restore VM1 by using the Replace existing restore configuration option.

C. Delete VM1.

D. Restore VM1 by using the Create new restore configuration option.

HOTSPOT -
You have an Azure subscription that contains the resources shown in the following table.
 
You plan to create a data collection rule named DCR1 in Azure Monitor.
Which resources can you set as data sources in DCR1, and which resources can you set as destinations in DCR1? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
 

HOTSPOT -
You have the role assignment file shown in the following exhibit.
 
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.
Hot Area:
 

HOTSPOT -
You have the following custom role-based access control (RBAC) role.
 
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
 

HOTSPOT -
You have an Azure subscription that contains the resources shown in the following table.
 
NSG1 is configured as shown in the following exhibit.
 
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
 

You have an Azure subscription named Subscription1 that contains two Azure virtual networks named VNet1 and VNet2. VNet1 contains a VPN gateway named
VPNGW1 that uses static routing. There is a site-to-site VPN connection between your on-premises network and VNet1.
On a computer named Client1 that runs Windows 10, you configure a point-to-site VPN connection to VNet1.
You configure virtual network peering between VNet1 and VNet2. You verify that you can connect to VNet2 from the on-premises network. Client1 is unable to connect to VNet2.
You need to ensure that you can connect Client1 to VNet2.
What should you do?

A. Select Use the remote virtual network’s gateway or Route Server on VNet1 to VNet2 peering.

B. Select Use the remote virtual network s gateway or Route Server on VNet2 to VNet1 peering.

C. Download and re-install the VPN client configuration package on Client1.

D. Enable BGP on VPNGW1.

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure subscription that contains the following users in an Azure Active Directory tenant named contoso.onmicrosoft.com:
 
User1 creates a new Azure Active Directory tenant named external.contoso.onmicrosoft.com.
You need to create new user accounts in external.contoso.onmicrosoft.com.
Solution: You instruct User1 to create the user accounts.
Does that meet the goal?

A. Yes

B. No

You have an Azure subscription that contains the virtual networks shown in the following table.
 
You need to ensure that all the traffic between VNet1 and VNet2 traverses the Microsoft backbone network.
What should you configure?

A. a private endpoint

B. peering

C. Express Route

D. a route table

You have an existing Azure subscription that contains 10 virtual machines.
You need to monitor the latency between your on-premises network and the virtual machines.
What should you use?

A. Service Map

B. Connection troubleshoot

C. Network Performance Monitor

D. Effective routes

You have an Azure subscription that contains two peered virtual networks named VNet1 and VNet2. VNet1 has a VPN gateway that uses static routing,
The on-premises network has a VPN connection that uses the VPN gateway of VNet1.
You need to configure access for users on the on-premises network to connect to a virtual machine on VNet2. The solution must minimize costs.
Which type of connectivity should you use?

A. Azure Firewall with a private IP address

B. service chaining and user-defined routes (UDRs)

C. Azure Application Gateway

D. ExpressRoute circuits to VNet2

HOTSPOT -
You have an Azure App Service plan named ASP1.
CPU usage for ASP1 is shown in the following exhibit.
 
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.
Hot Area:
 

You have an Azure subscription that contains two peered virtual networks named VNet1 and VNet2.
You have a Network Virtual Appliance (NVA) named NetVA1.
You need to ensure that the traffic from VNet1 to VNet2 is inspected by using NetVA1.
What should you use?

A. a local network gateway

B. a route table that has custom routes

C. a service endpoint

D. IP address reservations

DRAG DROP -
You have an Azure Linux virtual machine that is protected by Azure Backup.
One week ago, two files were deleted from the virtual machine.
You need to restore the deleted files to an on-premises Windows Server 2016 computer as quickly as possible.
Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Select and Place:
 

You have an Azure subscription that has a Recovery Services vault named Vault1. The subscription contains the virtual machines shown in the following table:
 
You plan to schedule backups to occur every night at 23:00.
Which virtual machines can you back up by using Azure Backup?

A. VM1 and VM3 only

B. VM1, VM2, VM3 and VM4

C. VM1 and VM2 only

D. VM1 only

HOTSPOT -
You purchase a new Azure subscription named Subscription1.
You create a virtual machine named VM1 in Subscription1. VM1 is not protected by Azure Backup.
You need to protect VM1 by using Azure Backup. Backups must be created at 01:00 and stored for 30 days.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
 

You have an Azure subscription that contains a virtual machine named VM1.
You plan to deploy an Azure Monitor alert rule that will trigger an alert when CPU usage on VM1 exceeds 80 percent.
You need to ensure that the alert rule sends an email message to two users named User1 and User2.
What should you create for Azure Monitor?

A. an action group

B. a mail-enabled security group

C. a distribution group

D. a Microsoft 365 group

You have the Azure virtual machines shown in the following table:
 
You have a Recovery Services vault that protects VM1 and VM2.
You need to protect VM3 and VM4 by using Recovery Services.
What should you do first?

A. Create a new Recovery Services vault

B. Create a storage account

C. Configure the extensions for VM3 and VM4

D. Create a new backup policy

HOTSPOT -
You have an Azure subscription that contains an Azure Storage account named storage1 and the users shown in the following table.
 
You plan to monitor storage1 and to configure email notifications for the signals shown in the following table.
 
You need to identify the minimum number of alert rules and action groups required for the planned monitoring.
How many alert rules and action groups should you identify? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
 

You have an Azure subscription that contains the identities shown in the following table.
 
User1, Principal1, and Group1 are assigned the Monitoring Reader role.
An action group named AG1 has the Email Azure Resource Manager Role notification type and is configured to email the Monitoring Reader role.
You create an alert rule named Alert1 that uses AG1.
You need to identity who will receive an email notification when Alert1 is triggered.
Who should you identify?

A. User1 and Principal1 only

B. User1, User2, Principal1, and Principal2

C. User1 only

D. User1 and User2 only

HOTSPOT -
You have an Azure virtual machine named VM1 and a Recovery Services vault named Vault1.
You create a backup policy named Policy1 as shown in the exhibit. (Click the Exhibit tab.)
 
You configure the backup of VM1 to use Policy1 on Thursday, January 1 at 1:00 AM.
You need to identify the number of available recovery points for VM1.
How many recovery points are available on January 8 and January 15? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
 

HOTSPOT -
You have the web apps shown in the following table.
 
You need to monitor the performance and usage of the apps by using Azure Application Insights. The solution must minimize modifications to the application code.
What should you do on each app? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:
 

You have an Azure virtual machine named VM1.
You use Azure Backup to create a backup of VM1 named Backup1.
After creating Backup1, you perform the following changes to VM1:
✑ Modify the size of VM1.
✑ Copy a file named Budget.xls to a folder named Data.
✑ Reset the password for the built-in administrator account.
✑ Add a data disk to VM1.
An administrator uses the Replace existing option to restore VM1 from Backup1.
You need to ensure that all the changes to VM1 are restored.
Which change should you perform again?

A. Modify the size of VM1.

B. Reset the password for the built-in administrator account.

C. Add a data disk.

D. Copy Budget.xls to Data.

HOTSPOT -
You have an Azure Active Directory (Azure AD) tenant named contoso.onmicrosoft.com that contains the users shown in the following table.
 
You enable password reset for contoso.onmicrosoft.com as shown in the Password Reset exhibit. (Click the Password Reset tab.)
 
You configure the authentication methods for password reset as shown in the Authentication Methods exhibit. (Click the Authentication Methods tab.)
 
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
 

Your company has a main office in London that contains 100 client computers.
Three years ago, you migrated to Azure Active Directory (Azure AD).
The company's security policy states that all personal devices and corporate-owned devices must be registered or joined to Azure AD.
A remote user named User1 is unable to join a personal device to Azure AD from a home network.
You verify that User1 was able to join devices to Azure AD in the past.
You need to ensure that User1 can join the device to Azure AD.
What should you do?

A. Assign the User administrator role to User1.

B. From the Device settings blade, modify the Maximum number of devices per user setting.

C. Create a point-to-site VPN from the home network of User1 to Azure.

D. From the Device settings blade, modify the Users may join devices to Azure AD setting.

HOTSPOT -
You have two Azure App Service app named App1 and App2. Each app has a production deployment slot and a test deployment slot.
The Backup Configuration settings for the production slots are shown in the following table.
 
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
 

HOTSPOT -
You have an Azure subscription that contains an Azure Active Directory (Azure AD) tenant named contoso.com. The tenant is synced to the on-premises Active
Directory domain. The domain contains the users shown in the following table.
 
You enable self-service password reset (SSPR) for all users and configure SSPR to have the following authentication methods:
✑ Number of methods required to reset: 2
✑ Methods available to users: Mobile phone, Security questions
✑ Number of questions required to register: 3
✑ Number of questions required to reset: 3
You select the following security questions:
✑ What is your favorite food?
✑ In what city was your first job?
✑ What was the name of your first pet?
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:
 

You have an Azure subscription that contains a Recovery Services vault named Vault1.
You need to enable multi-user authorization (MAU) for Vault1.
Which resource should you create first?

A. an administrative unit

B. a managed identity

C. a resource guard

D. a custom Azure role

HOTSPOT
-
You have an Azure subscription that contains the virtual networks shown in the following table.
 
Each virtual network has 50 connected virtual machines.
You need to implement Azure Bastion. The solution must meet the fallowing requirements:
• Support host scaling.
• Support uploading and downloading files.
• Support the virtual machines on both VNet1 and VNet2.
• Minimize the number of addresses on the Azure Bastion subnet.
How should you configure Azure Bastion? To answer, select the options in the answer area.
NOTE: Each correct answer is worth one point.
 

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an app named App1 that is installed on two Azure virtual machines named VM1 and VM2. Connections to App1 are managed by using an Azure Load Balancer.
The effective network security configurations for VM2 are shown in the following exhibit.
 
You discover that connections to App1 from 131.107.100.50 over TCP port 443 fail.
You verify that the Load Balancer rules are configured correctly.
You need to ensure that connections to App1 can be established successfully from 131.107.100.50 over TCP port 443.
Solution: You create an inbound security rule that allows any traffic from the AzureLoadBalancer source and has a priority of 150.
Does this meet the goal?

A. Yes

B. No

You have an Azure subscription that contains the resources shown in the following table.
 
You create a route table named RT1 in the East US Azure region.
To which resources can you associate RT1?

A. VNet1 only

B. Subnet1 only

C. VNet1 and NIC1 only

D. Subnet1 and NIC1 only

E. VNet1, Subnet1, and NIC1

You create an Azure VM named VM1 that runs Windows Server 2019.
VM1 is configured as shown in the exhibit. (Click the Exhibit tab.)
 
You need to enable Desired State Configuration for VM1.
What should you do first?

A. Connect to VM1.

B. Start VM1.

C. Capture a snapshot of VM1.

D. Configure a DNS name for VM1.

HOTSPOT
-
You have an Azure subscription that contains the virtual networks shown in the following table.
 
The subnets have the IP address spaces shown in the following table.
 
You plan to create a container app named contapp1 in the East US Azure region.
You need to create a container app environment named con-env1 that meets the following requirements:
• Uses its own virtual network.
• Uses its own subnet.
• Is connected to the smallest possible subnet.
To which virtual networks can you connect con-env1, and which subnet mask should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
 

You have an Azure subscription that contains the virtual networks shown in the following table.
 
All the virtual networks are peered. Each virtual network contains nine virtual machines.
You need to configure secure RDP connections to the virtual machines by using Azure Bastion.
What is the minimum number of Bastion hosts required?

A. 1

B. 3

C. 9

D. 10

HOTSPOT
-
You have an Azure subscription that contains the virtual networks shown in the following table.
 
The subscription contains the virtual machines shown in the following table.
 
Each virtual machine contains only a private IP address.
You create an Azure bastion for VNet1 as shown in the following exhibit.
 
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
 

HOTSPOT
-
You have an Azure subscription that contains the virtual networks shown in the following table.
 
The subscription contains the subnets shown in the following table.
 
The subscription contains the storage accounts shown in the following table.
 
You create a service endpoint policy named Policy1 in the South Central US Azure region to allow connectivity to all the storage accounts in the subscription.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
 

You have an Azure virtual network named VNet1 that contains the following settings:
• IPv4 address space: 172.16.10.0/24
• Subnet name: Subnet1
• Subnet address range: 172.16.10.0/25
What is the maximum number of virtual machines that can connect to Subnet1?

A. 24

B. 25

C. 123

D. 128

E. 251

You have an Azure subscription that contains a resource group named RG1 and a virtual network named VNet1.
You plan to create an Azure container instance named container1.
You need to be able to configure DNS name label scope reuse for container1.
What should you configure for container1?

A. the private networking type

B. the public networking type

C. a new subnet on VNet1

D. a confidential SKU

HOTSPOT
-
You have the Azure virtual machines shown in the following table.
 
VNET1, VNET2, and VNET3 are peered.
VM4 has a DNS server that is authoritative for a zone named contoso.com and contains the records shown in the following table.
 
The virtual networks are configured to use the DNS servers shown in the following table.
 
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
 

DRAG DROP
-
You have an Azure subscription that contains a resource group named RG1.
You plan to create an Azure Resource Manager (ARM) template to deploy a new virtual machine named VM1. VM1 must support the capture of performance data.
You need to specify resource dependencies for the ARM template.
In which order should you deploy the resources? To answer, move all resources from the list of resources to the answer area and arrange them in the correct order.
 

You have an Azure subscription.
You are creating a new Azure container instance that will have the following settings:
• Container name: cont1
• SKU: Standard
• OS type: Windows
• Networking type: Public
• Memory (GiB): 2.5
• Number of CPU cores: 2
You discover that the Private setting for Networking type is unavailable.
You need to ensure that cont1 can be configured to use private networking.
Which setting should you change?

A. Memory (GiB)

B. Networking type

C. Number of CPU cores

D. OS type

E. SKU