Answer – A

Yes, this is one of the requirements. This is also mentioned in the Microsoft documentation.

For more information on creating point-to-site VPN connections, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-point-to-site-resource-manager-portal

Answer – C

To access files from home computers, users have to use SMB protocol that expects port 445 to be open.

This is clearly given in the Microsoft documentation.

For more information on using file shares in Azure, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/storage/files/storage-how-to-use-files-windows

Answer – F

To work with UNC path format, you have to mount the Azure file share with File Explorer. The UNC path format is:

\\.file.core.windows.net\

or in our case:

\\whizlabstore.file.core.windows.net\demo

For more information on using Aure file share service, please visit the below URLs-

https://docs.microsoft.com/en-us/azure/storage/files/storage-how-to-use-files-windows

https://docs.microsoft.com/en-us/windows/win32/fileio/naming-a-file?redirectedfrom=MSDN

Answer – E

To work with UNC path format, you have to mount the Azure file share with File Explorer. The UNC path format is:

\\.file.core.windows.net\

or in our case:

\\whizlabstore.file.core.windows.net\demo

For more information on using Aure file share service, please visit the below URLs-

• https://docs.microsoft.com/en-us/azure/storage/files/storage-how-to-use-files-windows
• https://docs.microsoft.com/en-us/windows/win32/fileio/naming-a-file?redirectedfrom=MSDN

Answer – G

UNC stand for Universal naming convention. UNC is used  for Microsoft Windows for accessing shared network folder .and printer. Generic naming convention for UNC is given below: 

\\host-name\share-name\file path

To work with UNC path format, you have to mount the Azure file share with File Explorer. The UNC path format is:

\\.file.core.windows.net\

or in our case:

\\whizlabstore.file.core.windows.net\demo

From the above is it clear that G is the correct answer  all other answers are wrong.

For more information on using Azure file share service, please visit the below URLs-

• https://docs.microsoft.com/en-us/azure/storage/files/storage-how-to-use-files-windows
• https://docs.microsoft.com/en-us/windows/win32/fileio/naming-a-file?redirectedfrom=MSDN

Answer – A

So below is the representation of the network based on the details given in the question.

Since the whizlab-client is registered with the private hosted zone, automatic registration of VM’s is possible.

This is also given in the Microsoft documentation.

For more information on private DNS zones, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/dns/private-dns-overview
• https://docs.microsoft.com/en-us/azure/dns/private-dns-autoregistration

Answer – D

If RuleB is deleted, users won’t be able to access port 80 and the web server.

There is a Deny rule of RuleA for ports 50-60. Since DNS listens on port 53, you will not be able to access the DNS server. But you will still be able to connect to the virtual machine using Remote Desktop Protocol (RDP) under the Allow_rdp rule.

Because of this logic, all other options are incorrect.

For more information on network security, please visit the below URL-

• Azure network security groups overview | Microsoft Docs

Answer – A

This can be done from the Networking, as shown below.

Ensure to click on “Selected networks” and then enter the IP address range.

Since this is clear from the implementation, all other options are incorrect.

For more information on the Firewall and virtual network feature, please visit the below URL-

https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security?tabs=azure-portal

Answer – C

This can be done from the soft delete option from the storage account at any time by using the Azure portal, PowerShell, or Azure CLI.

Blob soft delete protects an individual blob, snapshot, or version from accidental deletes or overwrites by maintaining the deleted data in the system for a specified period of time. During the retention period, you can restore a soft-deleted object to its state at the time it was deleted.

Since this is clear from the implementation, all other options are incorrect.

Reference: Enable soft delete for blobs - Azure Storage | Microsoft Learn

Answer - B

SLOT 1 covers the word "deployment".

All other options are incorrect.

For more information on deploying templates via the CLI, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-template-deploy-cli

Answer - C

SLOT 2 covers "--template-file" option.

All other options are incorrect.

For more information on deploying templates via the CLI, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-template-deploy-cli

Answer — B

Role-based access control can be used to restrict access to resources. RBAC does not put any governance, regarding type of resources to be created. If you need to limit the resource creation, like provision VM's  only of a particular SKU's, you need to implement Azure policies.

You can use allowed virtual machine policy in this scenario: 

• Allowed Virtual Machine SKUs (Deny): Specifies a set of virtual machine SKUs that you can deploy as parameter to this policy. Any  VM SKU which is not in the  parameter list, cannot be created as per  this policy. Users will get a message  “VM SKU “is not allowed by the policy -- Allowed Virtual Machine SKUs. 

For more information on policy and role-based access control, please refer to following list. 

Policy -- Overview of Azure Policy - Azure Policy | Microsoft Docs

RBAC -- https://docs.microsoft.com/en-us/azure/role-based-access-control/overview

Answer - B

Azure locks are used to prevent users from accidentally deleting or modifying critical resources. If you need to limit the resource creation, like provision VM only of a particular SKU, you need to implement Azure policies. 

For more information on Azure locks, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-lock-resources

Answer - A

Yes, this can be done with Azure policies. There is also already an in-built policy which can implement this policy as shown below.

For more information on an example on this, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/governance/policy/samples/allowed-skus-storage

Answer – A

This can be done with the IP Flow Verify feature. The Microsoft documentation mentions the following.

Option B is incorrect since this feature is used to get the next hop type and IP address of a specific VM packet. 

Option C is incorrect since this feature is used for deep-dive network packet capture.

Option D is incorrect since this feature is a cloud-based solution that provides visibility into user and application activity in cloud networks.

For more information on the IP Flow Verify feature, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-ip-flow-verify-overview

Answer – C

This can be done with the Connection Monitor feature. The Microsoft documentation mentions the following.

Option A is incorrect since this feature is used to verify traffic flow based on security group rules.

Option B is incorrect since this feature is used to get the next hop type and IP address of a specific VM packet.

Option D is incorrect since this feature is a cloud-based solution that provides visibility into user and application activity in cloud networks.

For more information on the network watcher tool, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/network-watcher/connection-monitor-overview
• https://docs.microsoft.com/en-us/learn/modules/troubleshoot-azure-network-infrastructure/2-troubleshoot-networking-with-network-watcher

Answer – B

You can achieve 99.99% SLA on your virtual machines' infrastructure level by deploying them across availability zones.

The Microsoft documentation mentions the following.

Option A is incorrect since availability sets can only guarantee an SLA of 99.95%.

Option C is incorrect since this will not help ensure 99.99% availability for the architecture.

Option D is incorrect since this is normally used for disaster recovery purposes.

For more information on availability zones, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/availability-zones/az-overview

Answer – C

The task requires to support the Hot, Cool, and Archive tiers. There is only one option from our list of options that can provide this: StorageV2 or General Purpose v2 Storage Account. With this storage account type, we will have the complete functionality of the BLOB service.

Option A is incorrect since it does not support the access tiers.

Option B is incorrect since it does not support the access tiers.

Option D is incorrect since this is a service and not a storage account kind.

Option E is incorrect since it does not support the access tiers.

For more information on storage accounts, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/storage/common/storage-account-overview

Answer – A

Standard_GRS, which is geo-redundant storage would ensure that data is available in a secondary region if the primary region goes down.

The Microsoft documentation mentions the following.

Options B and D are incorrect since these don’t guarantee that data will be available if a region goes down.

Option C is incorrect since the costs would be more than Standard_GRS.

For more information on geo-redundant storage, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/storage/common/storage-redundancy-grs

Correct Answers: B and D 

• Option B is correct because a backup vault can be used for managing Azure disk snapshot life cycle management, as explained later.
• Option D is correct because the backup center is the best option for creating the backup vault 
• Option A is incorrect because the recovery service, vault, does not support, disk snapshot life cycle management. 
• Option C is incorrect because Azure site recovery is used for creating disaster recovery sites. 

Azure backup vault supports manage disk snapshot backup lifecycle, which is policy-driven and provides fast backup and recovery from the snapshot of managed disk. 

The backup process of the backup vault does not cause any performance issues on the virtual machine. It has virtually no administrative overhead and low cost.  We can easily create a backup vault from the backup center.

Backup Center provides a single unified management experience in Azure for enterprises to govern, monitor, operate and analyse backups at scale. 

The following figure shows how a backup vault can be created from the backup center

For more details, please refer to the following Azure documentation link 

• https://docs.microsoft.com/en-us/Azure/backup/disk-backup-overview 
• https://docs.microsoft.com/en-us/Azure/backup/backup-center-overview

Answer – D

If you try to run the query in Log Analytics, you will see the below output. It consists of a graph that has the Average of the Counter value on the Y-axis.

Since this is clear from the implementation, all other options are incorrect.

For more information on performing log queries, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/log-query-overview

Answer – D

Here the issue is that no public IP address has been assigned to the Virtual Machine. This is because the Virtual Machine is in a stopped state. So, you would need to start the Virtual machine. You will get a Public IP address and then connect to the Virtual Machine.

Option A is incorrect since this would stop the RDP connectivity.

Option B is incorrect since this is an Inbound connectivity issue.

Option C is incorrect since you can’t delete the default rules.

For more information on IP address types, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-ip-addresses-overview-arm

Correct Option: C

If the VPN device that you want to connect to has changed its public IP address, you need to modify the local network gateway to reflect that change

This is also given in the Microsoft documentation.

Since this is clearly mentioned in the Microsoft documentation, all other options are incorrect.

For more information on creating site-to-site VPN connections, please go ahead and visit the below URL-

• Connect your on-premises network to an Azure VNet: Site-to-Site VPN: PowerShell - Azure VPN Gateway | Microsoft Learn

Answer – B and E

Since we need to distribute traffic across the virtual machines, we can use either the Load Balancer or Application Gateway service.

The Microsoft documentation mentions the following on these services.

All of the other options are incorrect since the users access the Azure virtual machines via the private IP addresses. This is because the users are connecting via VPN’s. So we need to use internal load balancing solutions.

For more information on the load balancer and the application gateway, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-overview
• https://docs.microsoft.com/en-us/azure/application-gateway/overview

Answer – C

This can be accomplished by the Storage Account Contributor.

The Microsoft documentation mentions the following.

Options A and B are incorrect since these would provide more permissions than required.

Options D and E are incorrect since these roles don’t have the required permissions.

For more information on built-in roles, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

Answer – D

This can be accomplished with the Storage Blob Data Contributor.

The Microsoft documentation mentions the following.

Options A and B are incorrect since these would provide more permissions than required.

Options C and E are incorrect since these roles don’t have the required permissions.

For more information on built-in roles, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

Answer – E

This can be accomplished with the Storage Blob Data Owner. The Microsoft documentation mentions the following.

Options A and B are incorrect since these would provide more permissions than required.

Options C and D are incorrect since these roles don’t have the required permissions.

For more information on built-in roles, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

Answer – A

Only the BLOB service is supported by the Export job feature. This is also given in the Microsoft documentation.

Since this is clearly mentioned, all other options are incorrect.

For more information on Azure import/export requirements, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/storage/common/storage-import-export-requirements

Answer – B

An example of this is given in the Microsoft documentation.

Since this is clearly given in the Microsoft documentation, all other options are incorrect.

For more information on managing data disk, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/virtual-machines/windows/tutorial-manage-data-disk

Answer - A

An example of this is given in the Microsoft documentation.

Since this is clearly given in the Microsoft documentation, all other options are incorrect.

For more information on managing data disk, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/virtual-machines/windows/tutorial-manage-data-disk

Answer – C

An example of this is given in the Microsoft documentation.

Since this is clearly given in the Microsoft documentation, all other options are incorrect.

For more information on managing data disk, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/virtual-machines/windows/tutorial-manage-data-disk

Answer - C

An example of this is given in the Microsoft documentation.

Since this is clearly given in the Microsoft documentation, all other options are incorrect.

For more information on managing data disk, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/virtual-machines/windows/tutorial-manage-data-disk

Answer – B

An example of this is given in the Microsoft documentation.

Since this is clearly given in the Microsoft documentation, all other options are incorrect.

For more information on managing data disk, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/virtual-machines/windows/tutorial-manage-data-disk

Correct Answer – B

The backup operation failed because the VM is in Failed state. For a successful backup, the VM state should be Running, Stopped, or Stopped (deallocated).

Reference:

Troubleshoot backup errors with Azure VMs - Azure Backup | Microsoft Learn

Answer — B

Azure policy is applied to the Tenant Root Group. It means that it would be applied to all subscriptions and all resource groups within the subscription. A VM can be created only inside a network. If you need to create a virtual machine, you must have permission to create virtual network resources, required for VM provisioning. 

This policy “not allowed resources type" includes Microsoft.Network in its parameter list. So the policy will not allow the creation of any network resources. 

So, B is the correct answer. 

For more information on creating Azure Policies, please visit the below URL:

• https://docs.microsoft.com/en-us/azure/governance/policy/overview

Answer – C

To ensure that traffic can be forwarded across networks, you need to enable forwarded traffic settings.

This is like the Hub and spoke model given in the Microsoft documentation wherein you need to enable forwarded traffic.

Option A is incorrect since this is used when you have a classic deployment of a virtual network.

Option B is incorrect since the traffic should be enabled.

Option D is incorrect since this is when you want traffic to flow to an on-premise setup.

For more information on the hub-spoke setup, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/hub-spoke

Answer – A

In order to ensure that traffic is routed via the intrusion-based device, you need to set up a route table and add the route table to the subnets in the other virtual networks.

The diagram of the hub and spoke model also includes the use of a User-defined route (UDR), which is nothing but a custom route table.

Since this is clearly given in the Microsoft documentation, all other options are incorrect.

For more information on working with route tables, please visit the below URLs-

• https://docs.microsoft.com/en-us/azure/virtual-network/tutorial-create-route-table-portal
• https://docs.microsoft.com/en-us/azure/virtual-wan/scenario-route-through-nva

Answer - A

In order to ensure traffic can be forwarded, you need to enable IP forwarding. An example of this is given in the Microsoft documentation.

Since this is clearly given in the Microsoft documentation, all other options are incorrect.

For more information on working with route tables, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/virtual-network/tutorial-create-route-table-portal

Answer – B

Azure policies are used from a governance perspective and can’t be used to create bills department wise.

For more information on Azure policies, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/governance/policy/overview

Answer – A

Yes, you can use resource tags to organize your Azure resources and also apply billing techniques department wise. The Microsoft documentation mentions the following.

For more information on tagging resources, please visit the below URLs-

• https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/tag-resources
• https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/decision-guides/resource-tagging/?toc=/azure/azure-resource-manager/management/toc.json

Answer – B

This is used to control access to resources and can’t be used for billing purposes.

For more information on Role-based access control, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/role-based-access-control/overview

Answer – A

The Not allowed resource types policy is only applied to the resource group whizlabs-rg. You can move the virtual machine to another resource group.

For more information on Azure policies, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/governance/policy/overview

Correct Answer – B

Azure policies would only highlight the compliance of existing resources and enforce the policy restrictions on new resources.

Here, the virtual machine whizlabvm is currently in a running state, and the company assigns the "Not allowed resource types Azure policy" 

Not allowed resource types (Deny): Prevents a list of resource types from being deployed.

Hence the state of the virtual machine would remain as it is.

For more information on Azure policies, please visit the below URL-

• Overview of Azure Policy - Azure Policy | Microsoft Docs1
• Overview of Azure Policy - Azure Policy | Microsoft Docs2

Answer – B

Since there is a policy, "Not allowed resource types" policy in place that does not allow any actions on virtual networks, you cannot change the virtual networks."Not allowed resource types" means, it's built-in policy enables you to specify the resource types that your organization cannot deploy. Restricts which resource types can be deployed in your environment.You can modify the existing address space, but you cannot add an additional address space.

Not allowed resource types (Deny): Prevents a list of resource types from being deployed. So, you cannot do any updates or modifications to the resource with this policy.

After defining Not Allowed resource type policy on the Resource Group, it effects all the resources that are within it and also the new ones being added.

So, in this case, when you try to change the existing address space of Virtual Network2 error is displayed.

Below tested scenario is for your reference and we suggest you, please try this scenario at your end to get more idea.

For more information on Azure policies, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/governance/policy/overview

Answer – D

The format of the prefixMatch is container/folder: demo/data. 

An example of this is given in the Microsoft documentation.

Since this is clearly mentioned in the Microsoft documentation, all other options are invalid.

For more information on lifecycle management rules, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/storage/blobs/storage-lifecycle-management-concepts

Answer – B

Since the question states that we need to move the objects to the cool tier after 30 days, this should be the value for tierToCool.

An example of this is given in the Microsoft documentation.

Since this is clearly mentioned in the Microsoft documentation, all other options are invalid.

For more information on lifecycle management rules, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/storage/blobs/storage-lifecycle-management-concepts

Answer – C

Since the question states that we need to move the objects to the archive tier after 90 days, this should be the value for tierToArchive.

Since this is clearly mentioned in the Microsoft documentation, all other options are invalid.

For more information on lifecycle management rules, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/storage/blobs/storage-lifecycle-management-concepts

Answer – C

The URL of the accessing an object must be https://<storageAccountName>.blob.core.windows.net /<containerName>/<objectName>:

https://whizlabstore.blob.core.windows.net/demo/audio.log

The Microsoft documentation mentions the following on the format of the URL for blob objects.

Since this is clearly mentioned in the Microsoft documentation, all other options are invalid.

For more information on the blob service, please visit the below URL

• https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blobs-introduction

Answer – C

The secure way to implement this is to generate a shared access signature. The Microsoft documentation mentions the following.

All of the other ways are incorrect since they don’t provide secure access to the storage account object.

For more information on Shared access signatures, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/storage/common/storage-sas-overview

Answer – A

The Activity Log service provides insights for all resource activities within your subscription. An example of events recorded is shown below.

You can create alerts based on the Activity logs.

For more information on Azure activity logs, please visit the below URLs-

• https://docs.microsoft.com/en-us/azure/azure-monitor/platform/activity-log

Answer – B

The Azure Advisor service is used as a recommendation engine and can’t be used to record virtual machines' activities.

For more information on Azure Advisor, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/advisor/advisor-overview

Answer – B

The Service Health service is used to inform users of the health of Azure-based services.

For more information on Azure Service Health, please visit the below URL-

• https://azure.microsoft.com/en-us/features/service-health

Answer- B

We need to keep costs minimized. There is no mention in the question on Fault tolerance and disaster recovery. We can opt for Local Redundant storage.

Since this is the most cost-effective approach, all other options are incorrect.

For more information on Data Redundancy, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/storage/common/storage-redundancy

Answer – B

For the Virtual network, you need to have a gateway subnet.

The Microsoft documentation mentions the following.

Since this is clearly mentioned in the documentation, all other options are incorrect.

For more information on Site-to-Site VPN connections, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-site-to-site-resource-manager-portal

Answer – B

You need to add an Inbound security rule and not an Outbound Security rule.

For more information on network security, please visit the below URL-

• https://docs.microsoft.com/en-us/azure/virtual-network/security-overview