Answer – D

As per the case study, you have the following requirements.

• Move the existing documents to Azure Blob storage using the Internet.

You can easily copy files using the Azure Storage Explorer.

Options A and C are incorrect because this is used for File storage and not BLOB storage.

Option B is incorrect since this is normally used as a one-time transfer of a large amount of data to Azure.

For more information on the Azure Storage Explorer, please refer to the below URL-

• https://azure.microsoft.com/en-us/features/storage-explorer/

Answer – D

To back up any Azure resource, the first thing you need to do is create a Recovery Services vault. Your vault must be in the same region as your VM.

The below snapshot from the Microsoft documentation addressing the Recovery Services vault location.

Since the documentation clearly mentions this, all other options are invalid.

For more information on preparing your VM’s for backup, please refer to the below URL-

• https://docs.microsoft.com/en-us/azure/backup/backup-azure-arm-vms-prepare

Answer – A

Since there is no requirement to have multiple virtual networks, one network would suffice for this requirement.

For more information on Azure virtual networks, please go to the below URL-

• https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-overview

Answer – C

There are 3 layers as part of the case study

• A SQL database
• A web front end
• A processing middle tier

It would be preferential to have a separate subnet for each layer. An example diagram of an architecture separation for VM workloads is given in the Microsoft documentation.

For more information on the network overview for Virtual Machines, please go to the below URL-

• https://docs.microsoft.com/en-us/azure/architecture/example-scenario/infrastructure/multi-tier-app-disaster-recovery
• https://docs.microsoft.com/en-us/azure/virtual-machines/windows/network-overview

Answers – A and D

In the Case study, there are two requirements to join devices. 
    • There should be a pilot group so that the testing of devices joining Azure AD can be carried out.
    • When users joined their own devices to Azure AD, they need to use a phone verification method to verify their identity.
To fulfill the first requirement, we need to modify "Users may join devices to Azure AD" and select a pilot Azure AD group created earlier.
For the second requirement, we need to modify the "Require Multi-Factor Auth to join devices" settings and select a phone verification method.

The Microsoft documentation mentions the following to support this.

• Users may register their devices with Azure AD - You need to configure this setting to allow Windows 10 personal, iOS, Android, and macOS devices to be registered with Azure AD. If you select None, devices are not allowed to register with Azure AD. Enrollment with Microsoft Intune or Mobile Device Management (MDM) for Office 365 requires registration. If you have configured either of these services, ALL is selected and NONE is not available.
• Require Multi-Factor Auth to join devices - You can choose whether users must provide an additional authentication factor to join their device to Azure AD. The default is No. We recommend requiring multi-factor authentication when registering a device. Before you enable multi-factor authentication for this service, you must ensure that multi-factor authentication is configured to register their devices. For more information on different Azure multi-factor authentication services, see getting started with Azure multi-factor authentication.

Option B is incorrect since this is used for users granted local administrator rights on a device.

Option C is incorrect since this setting is to allow devices to be registered with Azure AD.

Reference: For more information on device settings, please go to the below URL

Manage devices in Azure AD using the Azure portal - Microsoft Entra | Microsoft Docs

Answer – C

If you have a Network Security group, change the Incoming rules to allow port 443. This is so that users from the Internet can access to the web server on the secure port 443.

Options A and D are incorrect since users need to connect to the web server. That means the incoming rule needs to be modified and not the outgoing rules.

Option B is incorrect since associating the Network Security Group with Multiple subnets will affect all the other application tiers.

For more information on Network Security Groups, please go to the below URL-

• https://docs.microsoft.com/en-us/azure/virtual-network/security-overview

Correct Answers(Ascending Order):

Reference:

• Deploy Azure File Sync | Microsoft Docs

Answer – C, D, and E

The benefit of tagging and billing is given in the Microsoft documentation.

Option A is incorrect since here, the resources are used across various departments and are not constrained via resource groups.

Option B is incorrect since the costing on a tag basis needs to be seen from Cost Analysis.

For more information on using tags, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-using-tags

Answer - C, E, and F

If you want to add a custom domain to Azure AD, first you need to add a domain name to the Azure AD. Then update DNS information at the domain registrar service. And finally, verify that you do own this domain name.

The Microsoft documentation gives the list of steps to add a custom domain.

Since this is clearly given in the documentation, all other options are incorrect.

For more information on adding custom domains, please go to the below URL-

• https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/add-custom-domain

Answer – B and C

To solve this problem you need to use a Standard Load balancer with two virtual machines as a backend pool.

This is clearly mentioned in the Microsoft documentation.

Since this is clearly given in the Microsoft documentation, all other options are incorrect.

For more information on the SLA for the Load balancer, please go to the below URL-

• https://azure.microsoft.com/en-us/support/legal/sla/load-balancer/v1_0/

Answer – C

An example of this is given in the Microsoft documentation.

Options A and B are incorrect since we don’t need to recreate an entire load balancer just for this scenario.

Option D is incorrect since this is used to attach a front-end IP to the load balancer.

For more information on port forwarding for the load balancer, please go to the below URL-

• https://docs.microsoft.com/en-us/azure/load-balancer/tutorial-load-balancer-port-forwarding-portal

Answer – C

The Microsoft documentation mentions Session Persistence or Source IP affinity mode, as mentioned below.

Option A is incorrect since this is used when you have multiple front-end IPs.

Option B is incorrect since this is used to check the health of the back-end VM’s.

Option D is incorrect since this is used for an idle timeout.

For more information on load balancer distribution mode, please go to the below URL-

• https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-distribution-mode

Answer - B

If you go to your subscription, look at the Cost Analysis, you can see a breakdown of each resource's costs.

The Cost Analysis section for the subscription allows you to see all the costs. Hence all other options are incorrect.

For more information on cost analysis, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/cost-management/quick-acm-cost-analysis

Answer – B

The right solution is to use Network Watcher.

A Data Collector Set is used to collect data for Performance counters.

For more information on Data Collector sets, please visit the below URL-

• https://docs.microsoft.com/en-us/dynamics-nav/how-to--view-performance-counter-data-for-a-data-collector-set

Answer - A

The Microsoft documentation mentions the following.

"Network Watcher variable packet capture allows you to create packet capture sessions to track traffic to and from a virtual machine. Packet capture helps to diagnose network anomalies both reactively and proactively. Other uses include gathering network statistics, gaining information on network intrusions, to debug client-server communications and much more."

For more information on Network watcher, please go ahead and visit the below URL-

• https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-packet-capture-overview

Answer – B

The creation of the metric Chart for Network Monitoring will reveal the number of packets coming into and out of the Virtual machine. But it will not do detailed packet inspection.

For more information on monitoring Virtual Machine, please go ahead and visit the below URL-

• https://docs.microsoft.com/en-us/azure/virtual-machines/windows/monitor

Answer – A

First, we need to get the role definition.

All other options are incorrect.

For more information on creating a custom role, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/role-based-access-control/custom-roles-powershell

Answer – B

After we created a new role definition for "Virtual Machine Reader" based on "Virtual Machine Contributor", we can commit a new role definition.

All other options are incorrect.

For more information on creating a custom role, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/role-based-access-control/custom-roles-powershell

Answer – B

Azure policies are used for governance purposes. The Microsoft documentation mentions the following.

Option A is incorrect since policies are used to control permissions at the resource property level.

Option C is incorrect since Azure AD roles are specifically meant to control access to Azure AD.

Option D is incorrect since there is no concept of subscription policies.

For more information on this example, one can go to the following URLs-

• https://docs.microsoft.com/en-us/azure/governance/policy/overview
• https://docs.microsoft.com/en-us/azure/governance/policy/tutorials/create-and-manage

Correct Answer – C

You can move Azure resources across subscriptions using the Move-AzResource PowerShell command. There are just some restrictions when moving Virtual Machines.

Below is the command provided in the Microsoft documentation.

Option A is incorrect since you don’t need to move the Virtual machine to any specific region before moving it to the destination.

Option B is incorrect since you can move resources across subscriptions.

Option D is incorrect since the right command is Move-AzResource.

For more information on moving virtual machines, one can go to the following link-

• https://docs.microsoft.com/en-us/azure/virtual-machines/windows/move-vm

Answer – A

In order to add a network interface to a virtual machine, the machine needs to be stopped first. The Microsoft documentation also mentions this.

Since the right option is given in the Microsoft documentation, all other options are invalid.

For more information on adding a network interface, one can go to the following link-

• https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface-vm

Answer – B

The issue could be due to the security groups. You can diagnose the issue using IP Flow Verify.

The Microsoft documentation mentions the following.

Option A is incorrect since this is normally used from an application diagnostics perspective.

Option C is incorrect since this is used to provide recommendations on various types of Azure resources.

Option D is incorrect since this is used mainly from a security aspect in Azure.

For more information on IP Flow Verify, one can go to the following link-

• https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-ip-flow-verify-overview

Answer - B

The Microsoft documentation mentions the following.

Since this is clearly given in the Microsoft documentation, all other options are incorrect.

For more information on packet capture, one can go to the following link-

• https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-packet-capture-manage-portal
• https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-packet-capture-overview

Answer – A

Here the main issue is that demovm is not started and doesn't have allocated an IP address. When you start demovm, you will get a public IP address, which will be assigned to the Network Interface.

The Network security groups are fine for allowing RDP access.

Option B is incorrect because adding a new interface will not solve the connectivity issue.

Options C and D are incorrect since you cannot delete the built-in network security group rules.

For more information on Network security groups, please go to the below URL-

• https://docs.microsoft.com/en-us/azure/virtual-network/security-overview

Answer – B

Here you need to add an incoming rule to allow traffic on port 80

Option A is incorrect since this needs to be done for the currently attached network interface.

Option C is incorrect since the incoming traffic needs to be allowed.

Options D and E are incorrect since you cannot delete the built-in network security group rules.

For more information on Network security groups, please go to the below URL

• https://docs.microsoft.com/en-us/azure/virtual-network/security-overview

Answer – A

If you go to the Resource Group blade, you can see the resource group's deployments. An example is shown below.

And if you open any deployment, you can see the template used for the deployment.

The other options are incorrect because these will not give the overall template deployment for multiple resources.

For more information on resource template deployments, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-template-deploy-portal

Answer – B

Since the IP address is not in the valid IP address range defined by the SAS, you will be denied access.

You will get the below error in Azure Storage Explorer.

All other options are incorrect.

For more information on Shared access signatures, please go to the below URL-

• https://docs.microsoft.com/en-us/azure/storage/common/storage-dotnet-shared-access-signature-part-1

Answer — B

"net use" command is a Command Prompt command that's used to connect to, remove, and configure connections to shared resources, like mapped drives and network printers."

As per the question, we need to use the "net use" command on a computer that has an IP address of 193.77.134.50 and then use SASdemo to connect to share1.

• The net use command is used to connect to file shares(SMB protocol), and SMB is not supported with SAS.
• Storage account key: To mount an Azure file share, you will need the primary (or secondary) storage key. SAS keys are not currently supported for mounting.

It is clear that B is the correct answer and the rest all other options are incorrect

References:

• SMB file shares in Azure Files | Microsoft Learn
• Mount SMB Azure file share on Windows | Microsoft Learn
• Grant limited access to data with shared access signatures (SAS) - Azure Storage | Microsoft Learn

Answer – A

The network interface for a Virtual Machine can have both a private and public IP address. 

So, by this measure, we only need to define 5 network interface cards, one for each virtual machine. 

It is clear that A is the correct answer and all the other options are incorrect. 

For more information on the virtual network interfaces in Azure, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface

Answer – A

A network security group can have multiple network interfaces assigned to it, as shown in the below diagram.

The question clearly states that the virtual machines all require the same inbound and outbound security rules. Hence we should use just the same network security group for all network interfaces.

For more information on network security groups, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-vnet-plan-design-arm

Answer – C

The Virtual Network has no address space relative to 192.168.1.0/24 as per the PowerShell output given in the Exhibit.

Hence first, you need to add an address space, as shown below.

After you save the address space, create a new subnet with the address space, and ensure that the VM is put in the new subnet.

Option A is incorrect since the network interface can only receive an address from 10.2.0.0/24 as per the PowerShell output given in the Exhibit.

Option B is incorrect since you need to add the address space 192.168.1.0/24 before adding the subnet.

Options D and E are incorrect since you need to add the address space and subnet and not delete the address space and subnet.

For more information on Virtual Networks, please go to the below URL-

• https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-overview

Answer – B

First, you need to add a new subnet, as shown below.

You can then add the new VM as part of the new subnet so that it receives the address from the 10.2.1.0/24 address space.

Option A is incorrect since the network interface can only receive an address from 10.2.0.0/24 as per the PowerShell output given in the Exhibit.

Option C is incorrect since we already have the required address space.

Options D and E are incorrect since you need to add the subnet and not delete the address space and subnet.

For more information on Virtual Networks, please go to the below URL-

• https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-overview

Correct Answer: C

You can deploy your web application to the App Service in a manual or automatic way. App Service provides the Deployment center (Number 1) for continuous deployment from different code management sources: GitHub, Bitbucket, and Local Git (Number 2). You also can use the cloud drives, like OneDrive and Dropbox, to sync a ready-to-deploy code with your application in production or any other environment. For the manual deployment, you can use zip or war compressed files, Visual Studio, FTP, etc. But you still need to test and verify your app before production deployment.

Azure App Service provides a special functionality to help you with testing, a new version verification, and seamless deployment to production. This functionality is the deployment slots. By default, every App Service app has one production slot. If you deploy an application to a Standard and above plan, you would have at least 5 deployment slots to publish or deploy your new code before a release. The deployment slot is another App service app. It has its own URL different from the main (production) application address.

You can select the Deployment slots item (Number 1) under the Deployment section. On the Deployment slots screen, select the Add Slot (Number 2), and the portal opens a new panel to the right to input information about your new slot. You need to provide the new slot’s name (Number 3). Azure will automatically create a web address for your new App service app. And then, you can push the Add button. After the new slot is created, you can deploy your new version to this slot. When you are ready to release, you can swap the slots by pushing the Swap button (Number 4).

Your new slot will become a production slot, and users can start using the new version of your application. If something happens with the release and you need to roll back to the previous version, you can use the same Swap button to make the old production application the current one.

All other options are incorrect.

For more information about App Service app deployment slots, please visit the below URLs:

• https://docs.microsoft.com/en-us/learn/modules/stage-deploy-app-service-deployment-slots/2-create-deployment-slots
• https://docs.microsoft.com/en-us/azure/app-service/deploy-staging-slots
• https://docs.microsoft.com/en-us/learn/modules/host-a-web-app-with-azure-app-service/6-deploying-code-to-app-service

Answer – C

The below snapshot from the Microsoft documentation shows the different types of storage accounts.

Option B is incorrect since General Purpose V1 is not available anymore.

As we can see that only General Purpose v2 supports all of the requirements. Hence all other options are incorrect.

For more information on storage accounts, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/storage/common/storage-account-overview

Answer – C

The Microsoft documentation mentions the following.

Options A and B are incorrect since these replication strategies don’t replicate the data across regions.

Option D is incorrect because additional read access to data in another region is not mentioned and we also have to keep the cost to a minimum.

For more information on storage redundancy, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/storage/common/storage-redundancy-grs

Answer — B

Virtual Machine Scale Sets is a free service, therefore, it does not have a financially backed SLA itself.  However, if the Virtual Machine Scale Sets include Virtual Machines in at least 2 Fault Domains, the availability of the underlying Virtual Machines SLA for two or more instances applies: 

Since in the question, creating scale set with fault domain/availability zone is not mentioned.  

It is clear that B is the correct answer. 

However, we can create an HA machine with Scale set as explain below:

While, creating virtual machines, with scale set  spreading algorithm, decide how VM's  will be allocated to different  fault domain. 

Max Spreading  -- VM are across as many fault domains as possible 

Fix Spreading -- VM are across  fault domain as per the user selection, unless user  select fix spread with 1 fault domain, the VM's will meet the SLA requirements of the virtual machine. 

 For details, please see the following link 

SLA for Virtual Machine Scale Sets | Microsoft Azure 

SLA for Virtual Machines | Microsoft Azure

Answer – A

The Microsoft documentation mentions the following.

For more information on availability sets, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/virtual-machines/windows/manage-availability

Answer – B

Azure Traffic Manager is used for traffic distribution based on DNS queries. For achieving high availability, you need to use Availability sets.

For more information on Azure Traffic Manager, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/traffic-manager/traffic-manager-overview

Answer — E

Azure always allocates the owner role to the user, who creates a new subscription. The owner role can perform any operation, on azure resources, including allocation/modification of the privileges of other users.  A contributor can do everything, which the owner can do, except, any operation related to users privileges. Network contributor is a specialization of contributor role, and it can do every operation related to the network. 

Option A is not the best option as both user1 and user3 can perform network operation  

Option B is incorrect because user2 can perform operations related to security, not  related to networking 

Option C is not the best answer(Same reason as option A) 

Option D is incorrect as user2 can not perform any network operation. 

Option F is incorrect due to the same reason as option D.

Option G is incorrect as it is just a distractor. 

 From the above, it is clear that only user1(owner) and user3(network contributor) can add resources to a network. Hence, E is the correct answer, while all other answers are wrong. 

Please see the following link for the network contribution role: 

https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#network-contributor

For more information on the built-in roles, please go to the below URLs: 

• https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles
• https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#network-contributor

Answer – A

The Network Contributor does not have access to assign roles. And if you look at the Security admin role, it only has the privilege to work with Security Center.

For more information on the built-in roles, please go to the below URLs-

• https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles
• https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#security-admin

Answer - B

If you look at the Microsoft documentation for the role definition, you can see that the correct action is "Microsoft.Authorization/*/read".

For more information on the built-in roles, please go to the below URL-

• https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

Answer – C

If you look at the Microsoft documentation for the role definition, you can see that the correct action is “Microsoft.Support/*”.

For more information on the built-in roles, please go to the below URL-

• https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

Answer – C

Since VNet2 has an overlapping CIDR block peering with VNet1 is not possible.  Hence peering is possible from VNet1 to VNet3 and VNet1 to VNet4. Below is the error that we get while configuring VNet2.

For more information on Virtual Network peering, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview

Answer – A

 VM1 can ping VM3 because peering between vnet1 and vnet3 has been established. 

Peering is always bidirectional and ping also requires bidirectional connectivity. 

It is clear that A is the correct answer. 

For more information on VNET peering, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview

In this question, we are asked to decide whether the statement “Has VNet2(VM) peered with VNet3(VM3)” is true or not. 

Answer — B (No)

 Peering is always bidirectional. Peering in VNet2(VM2) and VNet3(VM3) is shown as unidirectional. 

The main learning from this question is that the peering connection has two states - Initiated state ( as shown between VNet2 and VNet3 and the connected state. (as shown between VNet1 and VNet3. When the peering connection is in a connected state, it becomes bidirectional. 

A bidirectional link must be created in order to establish a successful connection 

Hence B is the correct answer 

For better understanding create peering with PowerShell/CLI.

In the Azure portal, both peering have been created in a single UI.

For more information on VNET peering, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview
• https://docs.microsoft.com/en-us/azure/virtual-network/create-peering-different-subscriptions

Answer — B

The following diagram represents peering establish between vnets. Diagram shows no peering between Vnet1 and Vnet2. 

Ping require bidirectional connectivity. It is clear that VM1 and VM 2 can not ping each other.

In view of above, B is the correct answer and all other answers are wrong. 

For more information on VNET peering, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview

Answer - F

As per the Microsoft documentation given below, only the General Purpose V2 and Blob storage account types support the Archive access tier.

As a result, all other options are incorrect.

For more information on storage accounts, one can go to the following link-

• https://docs.microsoft.com/en-us/azure/storage/common/storage-account-overview

Answer – C

Since we don’t want requests to flow via the Internet, we should create an internal load balancer. The Microsoft documentation mentions the following.

Option A is incorrect since this is created when requests need to flow via the Internet.

Options B and D are incorrect terms when it comes to the load balancer.

For more information on the Azure Load balancer, one can go to the following link-

• https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-overview

Answer – A and C

Managed Disks and Availability Sets can guarantee at least 99.5%  of the Virtual Machines availability.

The Microsoft documentation mentions the following.

• For any Single Instance Virtual Machine using Standard SSD Managed Disks for Operating System Disk and Data Disks, we guarantee you will have Virtual Machine Connectivity of at least 99.5%.
• For all Virtual Machines with two or more instances deployed in the same Availability Set or the same Dedicated Host Group, we guarantee you will have Virtual Machine Connectivity to at least one instance 99.95% of the time.

Option B is incorrect. Having multiple network interfaces can be used to recover applications on virtual machines since you can move network interfaces across virtual machines. But then here to ensure that you are guaranteed an SLA of 99.5% uptime, you should use Azure Managed Disks and/or Azure Availability Sets.

Option D is incorrect since this can be used to scale your application and can be used for high availability. 

For more information on managing availability for Virtual Machines, one can go to the below URLs-

• https://docs.microsoft.com/en-us/azure/virtual-machines/windows/manage-availability
• https://azure.microsoft.com/en-us/support/legal/sla/virtual-machines/v1_9/

Answer – C

Option C is correct: The question has the key requirement, “Storage replication needs to be in place to ensure that data is available even in the case of a data center failure”. This means that you need to use Zone redundant replication, which is available in General Purpose v2. Standard storage account type for blobs, file shares, queues, and tables. Recommended for most scenarios using Azure Storage. 

Option A is incorrect: Azure Blob storage is Microsoft's object storage solution for the cloud. Blob storage is optimized for storing massive amounts of unstructured data.

Option B is incorrect: General-purpose v1 is a legacy storage account type. These account types aren’t recommended by Microsoft. It may not have the latest features or the lowest per-gigabyte pricing.

Option D is incorrect: Azure Table storage is a service that stores structured NoSQL data in the cloud, providing a key/attribute store with a schemaless design.

Types of storage accounts

Azure Storage offers several types of storage accounts. Each type supports different features and has its own pricing model.

For more information on storage accounts, one can go to the below URL-

• https://docs.microsoft.com/en-us/azure/storage/common/storage-account-overview

Answer – B

You should ideally create availability sets based on the number of tiers you have for your application.

All other options are invalid.

For more information on availability sets, one can go to the below URL-

• https://docs.microsoft.com/en-us/azure/virtual-machines/windows/manage-availability

Answer – C

When you add a custom domain name in Azure AD, below is an example of what you would need to add to your domain registrar to complete the registration of the custom domain.

Since this is clearly shown, all other options are invalid.

For more information on custom domain names in Azure, one can go to the below URL-

• https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/add-custom-domain

Answer – B

Since the users will connect via HTTPS, that means that port 443 should be open. And we need to add an Inbound security rule. An example is shown below.

Option A is incorrect since this is the port for HTTP traffic.

Options C and D are incorrect since you need to modify the Inbound security rule.

For more information on security groups, one can go to the below URL-

• https://docs.microsoft.com/en-us/azure/virtual-network/security-overview

Answer – A

To have a successful point-to-site VPN connection, you need to install the exported client certificate to "WorkstationB".

For more information on point-to-site VPN, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-point-to-site-resource-manager-portal

Correct answers:

Azure Private Link helps users connect the Azure resources to their virtual networks without using the internet and public IPs. Instead of the internet, the customers use the Microsoft Azure backbone network. Instead of using public IP addresses for resource access, the resources are using the private IP addresses that Azure assigns to them using their virtual network’s subnets in the private link services.

For customers utilizing your Azure services from their virtual networks, you need to create an Azure Private Link. This link connects the Private Endpoint that customers add to their virtual network and the Private Link Service that you add to connect to your services running behind the Standard Azure Load Balancer.

For more information about Azure Load Balancer, Private Endpoint, Private Link, and Private Link Service, please visit the below URLs:

• https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-overview#securebydefault
• https://docs.microsoft.com/en-us/learn/modules/introduction-azure-private-link/3-how-azure-private-link-works
• https://docs.microsoft.com/en-us/azure/private-link/private-link-service-overview
• https://docs.microsoft.com/en-us/azure/private-link/private-endpoint-overview