Answer – B

Since rg-staging-2 has Read Only lock defined. Read lock means that user can not make any changes/updates in the resource group. Read lock is same as applying reader role on the Resource group. Reader role allow only */Read operation, excluding move operation. 

Hence B is the correct answer. For details please, see the following link. 

Azure built-in roles - Azure RBAC | Microsoft Docs

Lock resources to prevent changes - Azure Resource Manager | Microsoft Docs

Correct Answer — A

We can move resources from one resource group to another, and in this case the source resource group does not have any lock defined and receiving resource group has got delete lock, which stops from deleting of resources.  Below is the further explanation of what delete lock does.

Delete lock on a resource group means that any resource which is contained by a resource group cannot be deleted. The idea behind delete lock is to avoid any resource deletion even  by mistake. A resource group can be deleted by a user by mistake, in case, there is no lock on the resource group. A malicious user can also delete a group, without delete lock. This can cause serious problem in production system, and may even impact the end user. 

Delete lock puts no other restrictions. Resources can always be added to a resource group with delete lock. 

From this explanation it is clear that A (yes) is the correct answer, all other answers are wrong.

• https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources
• https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/move-resource-group-and-subscription

Note - below screenshots are added for reference purposes.

Answer — B 

Moving a resource from one Resource Group results in metadata changes, and it does not have any effect on resources. Both rg-staging-1 &  rg-production-4 do not have any locks. But, we still cannot move App Service resources from resource group"rg-staging-1" to the target resource group "rg-production-4" because it already contains web resources.

The destination resource group must not have any existing App Service resources. App Service resources include Web Apps, App Service plans, etc.

Here, rg-staging-1 --> has web application (app-whizlabsweb) with the App Service plan (ASP-whizlabsrg1-ba8c), and the target resource group (rg-production-4) ---> has a web application (app-prod-web).

As per Microsoft Documentation, Web resources in the destination group violate the rules for moving App Service resources from one subscription to another. 

It is clear that  B is the correct answer and A is the wrong answer.  

For more details, please see the following:

For more information on resource locks, please visit the following URL-

• Move Azure App Service resources across resource groups or subscriptions - Azure Resource Manager | Microsoft Docs

Answer – C

To provide the ability to add the backend pool, "whizlabusr" must have the read access to the details of the virtual machine and the virtual network. For this reason, the user should be assigned a Network Contributor role within the resource group. In this role, "whizlabusr" will have the read access to the VM and full access to the group's network resources.

The other options are all invalid since they would only provide access to the load balancer resource itself. They will not provide access to the other resources such as the virtual machines that needed to be added to the back-end pool.

For more information on Role-based access control, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#network-contributor
• https://docs.microsoft.com/en-us/azure/role-based-access-control/overview

Correct Answer – C

An Azure public load balancer is a load balancer that has been assigned a public IP and can be accessed from the internet. While a private or internal load balance has a private IP and cannot be accessed from outside the vnet. 

Options A & D are incorrect because there provide a lot more access than required 

Option B is incorrect  because it does not provide access to a public load balancer

Option C is correct because it will provide access to both public and private load balancers at whizlabs-rg resource group level. It also follows the principle of the least privileges. 

For more information on Role-based access control, please visit the following URL: 

• https://docs.microsoft.com/en-us/azure/role-based-access-control/overview

Answer – A

Since whizlabusr1 user has the role of Cloud Device Administrator and is a Group Owner, the user would be able to add registered or joined devices to the group.

The Microsoft documentation provides the following information about Cloud Device Administrator.

For more information about the Cloud Device Administrator role and on working with group administrators, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-accessmanagement-managing-group-owners
• https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/directory-assign-admin-roles#cloud-device-administrator-permissions

Answer – A
Since whizlabusr2 holds the role of "User Administrator" he/she can update the membership of any assigned group, regardless of whether they are owner of the group or not because of the role associated with.  He/She can add users, devices, to any assigned group in Azure AD.

Reference:

• https://docs.microsoft.com/en-us/answers/questions/40861/azure-ad-device-management-1.html
• https://docs.microsoft.com/en-us/azure/active-directory/devices/device-management-azure-portal
• https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference

Answer – B

Since the group is Dynamic in nature, you won’t be able to add users or devices to a group manually. Device whizlabvm2 shall be governed by Rules and automatically removed or added dynamically.

Reference: How to manage groups - Azure Active Directory - Microsoft Entra | Microsoft Learn

The device WhizlabVM2 is already "Azure AD joined". Hence WhizlabVM2 will be governed by AD rule 

For example, you have a Dynamic Group, as defined below.

The ability to Add members will be greyed out.

For more information on creating Dynamic groups, please visit the following URL-

• Create or edit a dynamic group and get status - Azure AD - Microsoft Entra | Microsoft Learn

Answer – D

You look at the comparison between the Standard and the Basic Load Balancer in the Microsoft documentation. It clearly mentions that the virtual machines need to be part of an availability set or a virtual machine scale set.

Since this is clearly mentioned in the documentation, all other options are incorrect.

For more information on the Azure Load Balancer, please visit the following URL-

• What is Azure Load Balancer? - Azure Load Balancer | Microsoft Learn
• Azure Load Balancer SKUs | Microsoft Learn

Answer – C

You look at the comparison between the Standard and the Basic Load Balancer in the Microsoft documentation. It clearly mentions that the virtual machines need to be part of a single virtual network.

Since this is clearly mentioned in the documentation, all other options are incorrect.

For more information on the Azure Load Balancer, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/load-balancer/skus

Answer – D

 3 tier  architecture shown below will help us to answer question number 11 and 12 . 

In Question 11, the Business Logic Tier has the requirement of NOT being accessible from the Internet. Hence, we should spin up an Internal Load Balancer with privat IP. 

Hence the correct answer is D and all other answer and All other answers are wrong. Please see the diagram below for better clearance. 

For more information on the Azure Load Balancer, please visit the following URL-

https://docs.microsoft.com/en-us/azure/virtual-machines/windows/tutorial-load-balancer#:~:text=An%20Azure%20load%20balancer%20is,incoming%20traffic%20among%20healthy%20VMs.&text=To%20distribute%20traffic%20to%20the,connected%20to%20the%20load%20balancer.

Answer - B 

To protect the web servers against SQL injection attacks, one can use the Web Application Firewall feature, as shown in the solution diagram below.  Application gateway has the option to provide a WAF firewall.  It is clear that B is the correct answer and all other answers are wrong. 

The Microsoft documentation mentions the following.

Since this is clearly mentioned in the documentation, all other options are incorrect.

For more information on the Web Application Firewall, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/ag-overview

Answer – A

In order to attach a network interface to a virtual machine, it must be created in the same region as the virtual machine. It also is a part of the same virtual network hosting the virtual machine.

Hence here, the requirements for ensuring the network interface can be attached to the virtual machine are met.

Below is an excerpt from the Microsoft documentation on the creation of a network interface.

For more information on network interfaces, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface

Requirement: Can we create a resource in a resource group, when the region for the resource and resource group are different 

Answer: A — Yes 

First, we need to understand the difference between data and metadata.  Metadata is not the actual data, but additional useful information about the data. A resource group contains metadata regarding azure resources, not the actual resources. A resource group contains the list of resources and some additional useful information like the region in which resources exist., components of each resource, etc…  In view of this, a resource group and actual resources contained by the resource group can be in a different regions. The basic constraint here is that a VM and all its components should be in the same network and in the same region.

In the given scenario, we are asked to create a new network interface wlsecnic and attached it to wlvm1, which resides in wl-network2. Since all these resources are in the West US region, it is possible to do so although wl-rg2 is a separate region (West Europe)

Here it should be noted that it is a good practice to create a resource group and its resources, in the same region. Sometimes, data residency and compliance requirements will also force us to create both in the same region.

Answer – B

In order to attach a network interface to a virtual machine, it must be created in the same region as the virtual machine. It also is a part of the same virtual network hosting the virtual machine.

Here the virtual machine is in the West US region and the network interface is being created in the Central US region.

For more information on network interfaces, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface

Answer – A

Here the recovery services vault (whizlabvault1) is located in the Central US region. This means that only resources in this region can be backed up in the recovery services vault. And for this, we have only the virtual machine located in this region.

Since this is the only approach for backing up data in the recovery services vault, all other options are incorrect.

For more information on the recovery services vault, please visit the following URLs-

• https://docs.microsoft.com/en-us/azure/backup/backup-azure-recovery-services-vault-overview
• https://docs.microsoft.com/en-us/azure/backup/backup-azure-arm-vms-prepare

Answer — B

In Azure recovery service vault (RSV), we can backup only those resources,  which are in same region as of RSV region. In the current scenario the RSV (whizlabvault2) region is west us. Storage account whizlabstore1 is also in the same region. Whizlabstore1 have two resource — A blob container named “whizlabdata” and a file share named “whizlabfiledata”. Azure blob data cannot be backup in RSV (it requires a backup vault). In RSV, However, azure file share can be backup. There are no other resources in the same region other than these two.

It is clear that B is the correct answer and all other answers are wrong.

• https://docs.microsoft.com/en-us/azure/backup/backup-azure-recovery-services-vault-overview

Correct Answer – D

When a device is joined to Azure AD, the user who joins the computer to the domain is added as the local administrator. Also, the Global Administrator will be added as an administrator to the system. 

Hence D  is the correct answer and all other answers are wrong. 

This is also mentioned in the Microsoft documentation.

For more information on managing the local administrators in the Azure AD join process, please visit the following URL-

• How to manage local administrators on Azure AD joined devices - Microsoft Entra | Microsoft Docs
• Azure AD built-in roles - Azure Active Directory - Microsoft Entra | Microsoft Docs

Correct Answers: B and E

Unfortunately, Azure does not allow to scale Azure Container Instances. You need to delete the current ACI and create a new instance with the new resource requirements. The most convenient way is to reuse and run the ARM template from the previous ACI deployment. You can find the template under the Deployments section on the ACI’s resource group blade. When you select the deployment template and click on the Redeploy button on the top bar, the Azure portal opens the Custom deployment screen (Number 1). Here you click on the “Edit Parameters (Number 2) and can change the number of CPU cores, memory, restart policy, etc. (Number 4). If you have not deleted the previous ACI and keep the same name for the new instance (Number 3), you will get a deployment failed error when you click on the Create button after a review.

The error status message is the following.

Therefore, you must delete the old ACI or change the name of the new ACI.

All other options are incorrect.

For more information about creating and updating the ACI using the ARM templates, please visit the below URLs:

• https://docs.microsoft.com/en-us/azure/container-instances/container-instances-update#properties-that-require-container-delete
• https://docs.microsoft.com/en-us/azure/container-instances/container-instances-quickstart-template

Correct Answers: B, E and F

You can create the groups of the ACI containers. These ACI groups are similar to AKS pods. The group is a collection of containers that runs or schedules on the same host machine. It shares the host’s resources, local network, and storage volumes. You can deploy the multi-container group only on Linux using ARM templates, YAML scripts, or Docker Compose.

• Option B is correct because the containers in the ACI group share the same resources of the host machine. The containers share not only the same resources but also local network and storage volumes.
• Option E is correct because the ACI group can include the init containers. This container type prepares the run of your application. They set up accounts, databases, or running scripts. Only after the init containers finish their jobs the application containers start.
• Option F is correct because currently, you can create multi-container ACI groups on Linux only.
• Option A is incorrect because the ACI group is similar to the AKS pods but not to the AKS nodes.
• Option C is incorrect because you need to delete the old ACI group and create a new one with additional containers. Usually, you can deploy a multi-container group using ARM templates or YAML scripts. The Docker Compose can also be used.
• Option D is incorrect because the ACI multi-container group shares the same host machine, and you cannot dedicate any VMs to a particular container.

For more information about Azure Container Instance groups, please visit the below URLs:

• https://docs.microsoft.com/en-us/azure/container-instances/container-instances-container-groups
• https://docs.microsoft.com/en-us/azure/container-instances/container-instances-multi-container-group
• https://docs.microsoft.com/en-us/azure/container-instances/container-instances-init-container

Correct Answer: C

Azure provides two types of storage for AKS: Azure Disks and Azure Files. If you need to have persistent storage for a pod, you should use the Azure Disks. For accessibility to the data from the multiple pods simultaneously, you need to use shared Azure Files.

Both Azure Disks and Azure Files come in Premium and Standard Options. The Premium option uses the high-performance SSDs, and the Standard — regular HDDs. You can provision both storage types as Static or Dynamic volumes.

Data volumes using Azure Files are mounted as SMB 3.0 shared drives.

When you define an application deployment manifest (deployment.yaml), you provide the storage type and additional information for storage access, like a storage secret (created based on Azure storage account and storage key), share name, and type of access (Number 1).

All other options are incorrect.

For more information about Azure storage options for AKS nodes and pods, please visit the below URL:

• https://docs.microsoft.com/en-us/azure/aks/concepts-storage
• https://docs.microsoft.com/en-us/azure/aks/operator-best-practices-storage
• https://docs.microsoft.com/en-us/azure/aks/azure-files-volume#create-an-azure-file-share
• https://docs.microsoft.com/en-us/learn/modules/aks-deploy-container-app/5-exercise-deploy-app

Answer – D

When transferring a large amount of data to an Azure storage account, you can transfer data to Azure blob storage or Azure file storage.

The Microsoft documentation mentions the following.

Since this is clear from the Microsoft documentation, all other options are incorrect.

For more information on the Import-Export service, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/storage/common/storage-import-export-service

Answer – B

For administrators, the password reset policy is different, wherein they are not asked for security questions.

The Microsoft documentation mentions the following.

For more information on the password reset policy for administrators, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-policy

Answer - B

For administrators, the password reset policy is different, wherein they are not asked for security questions.

The Microsoft documentation mentions the following.

For more information on the password reset policy for administrators, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-policy

Correct Answer – A

Since SSPR has been enabled for all users. The user would need to answer the security-related question to reset their password.

For more information on how password reset works, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-howitworks

Correct Answers:

• Azure Backup supports the backup of Azure VMs that have their OS/data disks encrypted with Azure Disk Encryption (ADE).
• Azure Disk Encryption for Windows virtual machines (VMs) uses the BitLocker feature of Windows to provide full disk encryption of the OS disk and data disk.
• Azure Disk Encryption requires an Azure Key Vault to control and manage disk encryption keys and secrets. Your key vault and VMs must reside in the same Azure region and subscription
• Azure Disk Encryption uses the DM-Crypt feature of Linux to provide volume encryption for the OS and data disks of Azure virtual machines (VMs)k encryption keys and secrets.

References:

• Back up and restore encrypted Azure VMs - Azure Backup | Microsoft Docs
• Azure Disk Encryption scenarios on Windows VMs - Azure Virtual Machines | Microsoft Docs
• Enable Azure Disk Encryption for Windows VMs - Azure Virtual Machines | Microsoft Docs
• Enable Azure Disk Encryption for Linux VMs - Azure Virtual Machines | Microsoft Docs

Answer – B

In order to add the virtual machine to the virtual network, the virtual machine needs to be in the same region as the virtual network, which is not the case over here.

The virtual machine is in the West US region and the whizlabnetwork2 virtual network is in the East Asia region.

For more information on virtual networks and virtual machines, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/virtual-machines/windows/network-overview

Answer – A

Yes, this is the right approach. You will have to delete the virtual machine and then create the virtual machine in the East Asia region.

For more information on virtual networks and virtual machines, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/virtual-machines/windows/network-overview

Answer – B

In order to add the virtual machine to the virtual network, the virtual machine needs to be in the same region as the virtual network, which is not the case over here.

The virtual machine is in the West US region and the whizlabnetwork2 virtual network is in the East Asia region.

For more information on virtual networks and virtual machines, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/virtual-machines/windows/network-overview

Answer – D

Since the networks are isolated from each other, you still need to ensure that the machines can communicate across the virtual networks. And this can be accomplished with the help of the virtual network peering connections.

Options A and B are incorrect since service endpoints should be used when you want to connect virtual networks securely to other Azure-based services.

Option C is incorrect since this should be used when you want to forward DNS requests to the Azure DNS servers.

For more information on virtual network peering connections, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview

Answer – D

You want to restore the folder on another virtual machine. You should install the Microsoft Azure Recovery Services Agent on the destination virtual machine.

Options A and B are incorrect since we want to restore the files using the Microsoft Azure Recovery Services Agent.

Option C is incorrect. We already have the MARS agent running on this machine to take the backup.

For more information on using the backup agent on Windows machines, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/backup/backup-windows-with-mars-agent

Answer – A

You can actually create alerts in Azure Monitor based on the events recorded in the Log Analytics workspace.

The Microsoft documentation also has a tutorial on this.

For more information on the tutorial itself, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/azure-monitor/learn/tutorial-response

Answer – B

You actually have to record the events in a Log Analytics workspace. And then configure alerts in Azure monitor based on the Azure Log Analytics workspace.

For more information on a tutorial on how this can be achieved, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/azure-monitor/learn/tutorial-response

Answer – B

You actually have to record the events in a Log Analytics workspace. And then configure alerts in Azure monitor based on the Azure Log Analytics workspace.

For more information on a tutorial on how this can be achieved, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/azure-monitor/learn/tutorial-response

Correct Answer: B

When you create an AKS cluster, you have two choices of the network models for Azure virtual networking: Kubenet and Azure Container Networking Interface (CNI). The main difference between the two models is in providing IP addresses to the pods. The Kubenet (Number 3) is the basic networking model that receives the IP addresses for the nodes from the Azure Vnet subnet, but the pods are served with logically different IP address space: Pod CIDR (Number 4). The pods cannot communicate directly with each other. They have to use Network Address Translation (NAT) to reach any resources on the VNet. In the Azure CNI (Number 1), the pods directly receive IP addresses from the subnet pool. Therefore, there is no value for the Pod CIDR (Number 2). For CNI, you need to plan your address space beforehand to avoid running out of the subnet addresses if you have many pods.

The Kubenet creates an internal Kubernetes virtual network. The Pod CIDR assigns the /24 address space for each node in the cluster. The first node has an internal space of 10.244.0.0/24, then — 10.244.1.0/24 for the next node, and so on (Number 1). And the routing table connects the pods with the Vnet (Number 2 and 3).

The pods IP addresses for the first node will start from 10.244.0.1 and for the second node — from 10.244.1.1, etc.

All other options are incorrect.

For more information about AKS networking, please visit the below URLs:

• https://docs.microsoft.com/en-us/azure/aks/concepts-network
• https://docs.microsoft.com/en-us/azure/aks/configure-kubenet#create-an-aks-cluster-in-the-virtual-network
• https://docs.microsoft.com/en-us/azure/aks/configure-kubenet
• https://docs.microsoft.com/en-us/azure/aks/configure-azure-cni

Correct Answers: C and F

Suppose you want Azure to add resources for your web app automatically. First, you need to evaluate your App Service plan and then configure the conditions for the app scaling. The automatic process of adding the VM resources is called autoscaling.

The App Service plan provides the VM configuration (CPU, memory, disk space), custom domains, certificates, autoscaling, etc. You can change the plan tier if you need more memory or CPU or a number of additional VM instances to run your app. Changing the App Service plan and scaling the resources mentioned above is called Scale up.

When you need to add more VM instances to run your app based on the metric or schedule, this scaling is called Scale out.

The shared compute tier (Free and Basic tiers) of the App Service plan does not provide the autoscaling functionality. You can scale your app resources manually up to 3 VM instances, if they are available, only in the Basic (B1, B2, and B3) tier. The Free tier does not have this ability. Starting from the Standard tier (S1, S2, S3) and up, the App Service plans provide the autoscaling functionality with up to 30 VM instances in the Premium (P1, P2, P3) tier. The Scale up to S1 tier provides the autoscale functionality with up to 10 VM instances.

After changing the plan from B1 to S1 tier, you will see the autoscale option (Number 2) in the Scale out (App Service plan) section (Number 1). You select the Scale mode based on a metric (Number 3) and Add a rule (Number 4). The portal opens the new section to the right — Scale rule (Number 5). You can use this screen to create your scaling rule based on the metric, like “CPU Percentage,” define the trigger threshold, like CPU load above 70% for 10 minutes, (Number 7), and the Action, like add a new VM instance if the above conditions are met (Number 8).

All other options are incorrect.

For more information about scaling settings in App Service Plan, please visit the below URLs:

• https://docs.microsoft.com/en-us/azure/azure-monitor/autoscale/autoscale-get-started
• https://docs.microsoft.com/en-us/azure/app-service/manage-scale-up
• https://docs.microsoft.com/en-us/azure/app-service/overview-hosting-plans
• https://docs.microsoft.com/en-us/learn/modules/app-service-scale-up-scale-out/2-scale-a-web-app-manually

Correct Answers: B, C and E

After you create your web app, you can use two options on the App service blade under the Settings section: Authentication or Authentication (classic). If you decide to use the Authentication (classic), the Azure portal will ask you to convert to the current Identity Provider Authentication that Authentication provides.

When you open the Authentication, you need to choose an Identity provider for your web app authentication. There are several options to select from: Microsoft (including Azure AD identities), Facebook, Google, and Twitter. For the Azure AD identities, choose Microsoft (Number 1).

After you select Microsoft as the identity provider (Number 1), the new screen asks you to register your app within the Azure AD (Number 2) and define the App Service authentication settings to require authentication (Number 3).

After pushing the Add button, only users of your organization can access your web app. You can verify that if you open the app as an Azure AD registered app (Number 1).

All other options are incorrect.

For more information about App Service security, please visit the below URLs:

• https://docs.microsoft.com/en-us/azure/app-service/overview-security
• https://docs.microsoft.com/en-us/azure/app-service/overview-authentication-authorization
• https://docs.microsoft.com/en-us/azure/app-service/scenario-secure-app-authentication-app-service

Correct Answers: A, B and F

You can create a manual or scheduled backup for your web application and use the backup to restore your app. There are three main steps to create a web app backup:

• Create a storage account
• Create a storage container
• Create a web app backup

To create a storage account using Azure CLI, you need to run az storage account create command and provide the account name, resource group, location, and account type and redundancy in the form of SKU:

az storage account create --name yourstoragename --resource-group yourrgname --location yourlocation --sku Standard_LRS

Next, you need to create a storage container using az storage container create command:

az storage container create --account-name yourstoragename --name yourcontainername

After creating a container, you need to construct the URL for the container using the SAS token, like this:

sasurl=https://yourstoragename.blob.core.windows.net/yourcontainername?$sastoken

You can generate the SAS token by using az storage container create generate-sas command.

And finally, you can run the az webapp config backup update command, like this for a backup every 3 days and 21 days of retention:

az webapp config backup update --resource-group yourrgname --webapp-name yourwebappname --container-url $sasurl --frequency 3d --retain-one true --retention 21

You can back up not only your web app but also the database that it uses. However, the total size of your web app backup, including the database, should not exceed 10 GB. The backups are stored as .zip files in a storage container. The database backup is stored in the root of the zip file.

All other options are incorrect.

For more information about App Service app backups, please visit the below URLs:

• https://docs.microsoft.com/en-us/azure/app-service/manage-backup
• https://docs.microsoft.com/en-us/azure/app-service/scripts/cli-backup-scheduled?toc=/cli/azure/toc.json

Answer – B

Here you have to ensure that the client certificate is installed on every client computer. It needs to establish a Point-to-Site VPN connection to the Azure virtual network.

For more information on Point-to-Site VPN connections, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/vpn-gateway/point-to-site-about

Answer – B

Here you have to ensure that the client certificate is installed on every client computer that needs to establish a Point-to-Site VPN connection to the Azure virtual network

For more information on Point-to-Site VPN connections, please visit the following URL

• https://docs.microsoft.com/en-us/azure/vpn-gateway/point-to-site-about

Answer – A

The right approach is to install the client certificate on every computer that needs to establish a Point-to-Site VPN connection to the Azure virtual network

The Microsoft documentation mentions the following

For more information on Point-to-Site VPN connections, please visit the following URL

• https://docs.microsoft.com/en-us/azure/vpn-gateway/point-to-site-about

Answer – B

There is no need to use the Azure Active Directory to authenticate the whizlabclient2 computer.

Azure accepts a P2S VPN connection, but the user has to be authenticated first. 

There are two mechanisms that Azure offers to authenticate a connecting user.

1. Authenticate using the native Azure certificate authentication

2.  Authenticate using the native Azure Active Directory authentication

So there is already native Azure Certificate authentication used for clients connecting to a VNet over a Point-to-Site VPN connection. 

Once you obtain a root certificate, you upload the public key information to Azure. The root certificate is then considered 'trusted' by Azure for connection over P2S to the virtual network. You also generate client certificates from the trusted root certificate and then install them on each client computer. The client certificate is used to authenticate the client when it initiates a connection to the VNet. 

In the question, it is already mentioned that a VPN client should have a VPN client certificate so there is no need for AD authentication. Hence B is the right answer. 

For more information on Point-to-Site VPN connections, please visit the following URL

• https://docs.microsoft.com/en-us/azure/vpn-gateway/point-to-site-about

Answer – B

First, we need to create a virtual network.

All other options are incorrect.

For more information on working with Private DNS, please visit the following URL

• https://docs.microsoft.com/en-us/azure/dns/private-dns-getstarted-cli

Answer – A

Next, we have to go ahead and create the private dns zone

All other options are incorrect.

For more information on working with Private DNS, please visit the following URL

• https://docs.microsoft.com/en-us/azure/dns/private-dns-getstarted-cli

Correct Answer – D

Slot 3 will be az network private-dns link

We have to create a virtual network link for the zone. See the example given below.

Below example creates a virtual network named myAzureVNet. Then it creates a DNS zone named private.whizlabs.com in the MyAzureResourceGroup resource group, links the DNS zone to the MyAzureVnet virtual network, and enables automatic registration.

az network vnet create \
  --name myAzureVNet \
  --resource-group MyAzureResourceGroup \
  --location eastus \
  --address-prefix 10.2.0.0/16 \
  --subnet-name backendSubnet \
  --subnet-prefixes 10.2.0.0/24

az network private-dns zone create -g MyAzureResourceGroup \
   -n private.whizlabs.com

az network private-dns link vnet create -g MyAzureResourceGroup -n MyDNSLink \
   -z private.whizlabs.com -v myAzureVNet -e true

All other options are incorrect.

For more information on working with Private DNS, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/dns/private-dns-getstarted-cli
• https://docs.microsoft.com/en-us/cli/azure/network/private-dns/link/vnet?view=azure-cli-latest

Answer – B

Option B is correct because it is the cost-effective option.

Option A is incorrect: Backup & restore was not available for the Free plan.

Options C and D are incorrect because these are not cost-effective options and are costlier than Basic Plan.

In  Azure App Service, you can easily restore app backups.  Backup and restore are supported in Basic, Standard, Premium, and Isolated tiers.

For the Basic tier, only the production slot can be backed up and restored. For more information about scaling your App Service plan to use a higher tier, see Scale up an app in Azure.

This is also mentioned in the Microsoft documentation.

Reference: Back up an app - Azure App Service | Microsoft Learn

Answer – A, D, and E

To record the successful and failed connection requests, we should use Azure Network Watcher flow logs. The Network Watcher is already enabled in the region, and we can utilize the Network Watcher NSG's flow log functionality. For that, we need to register the microsoft.insights resource provider and create a storage account for storing the flow logs.

The Microsoft documentation mentions the following.

Since this approach is given in the documentation, all other options are incorrect.

For more information on Azure Network Watcher flow logs, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-nsg-flow-logging-portal

Correct Answers: A, B and D

• Option A is correct because the Azure scale set can be used for auto-scaling.
• Option B is correct because we need to configure the min and max number of VM for auto-scaling.
• Option D is correct, as we need to define the auto-scaling rule, both for scaling out and scaling in.
• Option C is incorrect because pay using the pay as you go option is not the correct purchase option for a VM which is going to run 24×7×365. The best option for this type of VM is the reservation option, which can provide nearly 70% saving in the cost.

Answer – C

The next step is to go ahead and create the Kubernetes cluster.

An example of this is also given in the Microsoft documentation.

Since this is clearly given in the Microsoft documentation, all other options are incorrect.

For more information on working with Azure Kubernetes, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/aks/kubernetes-walkthrough

Answer – A

We have to ensure that monitoring is enabled for the cluster. We have to use the --enable-addons switch.

An example of this is also given in the Microsoft documentation.

Since this is clearly given in the Microsoft documentation, all other options are incorrect.

For more information on working with Azure Kubernetes, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/aks/kubernetes-walkthrough

Answer – B

Here we need to route traffic based on different URL’s . This is clearly mentioned the case study

http://whizlabs.com/video/* 

http://whizlabs.com/images/*

Hence we should use a URL path-based routing rule. 

Hence Answer B is correct and all other answer are wrong. 

This is also given in the Microsoft documentation. 

Since this is clearly given in the Microsoft documentation, all other options are incorrect.

For more information on the Azure Application Gateway, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/application-gateway/features

Answer – E

Please see the link for case study on the top of the right-hand corner. This case study clearly mentions that whizlabgateway2 must rout request to 2 backend pool - whizlabpool3 and whizlabpool4.

Since we need to direct requests based on different sites, we need to use multi-site listeners.  Hence E is the correct answer and all  other answers are wrong. This is also given in the Microsoft documentation. 

Since this is clearly given in the Microsoft documentation, all other options are incorrect.

For more information on the Azure Application Gateway, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/application-gateway/features

Answer – B

You have to create a service endpoint and configure network access to the storage account for this requirement.

For more information on service endpoints, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview

Answer - B

For this requirement, you have to create a service endpoint and configure network access to the storage account.

For more information on service endpoints, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview

Answer – A

Yes, this would fulfill the requirement.

First, you should add a service endpoint for the virtual network.

And then ensure to limit the traffic from the virtual network in the storage account.

For more information on service endpoints, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview