Answer — A

Delete lock on a resource group, means that any resource, which is contained by a resource group, cannot be deleted. The idea behind delete lock is to avoid any resource deletion by mistake. Moreover, if an entire resource group is deleted, in production, by a malicious user or by mistake, it can cause serious problems, which may even impact the end-users. Delete lock puts no other restrictions. Resources can always be added to a resource group with a delete lock.

From this explanation, it is clear, that correct  A (yes) is the correct answer, and all other answers are wrong.

For more information on resource locks, please visit the following URL: 

• https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources

Answer - A

We would be able to move the resource whizlabnetwork from the resource group whizlabs-rg1 to whizlabs-rg2. The virtual network whizlabnetwork has a Read-only lock. It means that we can't delete or modify this resource without removing the lock. But this lock doesn't prevent us from moving a resource from one resource group to another. The current whizlabnetwork resource group, whizlabs-rg1, doesn't have any locks. The destination resource group, whizlab-rg2, has a Delete lock. This lock prevents the deletion of this resource group and all resources within it. It doesn't restrict the movement of the resources to this group from other groups.

Hence, A is the correct answer. 

For more information on resource locks, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources

Answer – A

We would be able to move the resource whizlabip from the resource group whizlabs-rg1 to whizlabs-rg2. The public IP address whizlabip and it's resource group, whizlabs-rg1, don't have any locks. The destination resource group, whizlab-rg2, has a Delete lock. This lock prevents the deletion of this resource group and all resources within it. But it doesn't restrict the movement of the resources to this group from other groups.

For more information on resource locks, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources

Answer – A

whizlabusr1 user has the Global Administrator role and has created the new directory. The user would have the required permissions to create new users in the directory.

For more information on creating a new directory, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-access-create-new-tenant

Answer – B

The user whizlabusr2  is only the Global Administrator for the whizlabs.onmicrosoft.com directory. To add users to the new staging.whizlabs.onmicrosoft.com directory, whizlabusr2 needs to have the required role in the new directory.

For more information on creating a new directory, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-access-create-new-tenant

Answer – B

The user whizlabusr3 is only the User Administrator for the whizlabs.onmicrosoft.com directory. To add users to the new staging.whizlabs.onmicrosoft.com directory, whizlabusr3 needs to have the required role in the new directory.

For more information on creating a new directory, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-access-create-new-tenant

Answer – B

To create a VNet-to-VNet VPN between two virtual networks, you need to have a special subnet - gateway subnet. Azure recommends reserve /27 or /28 CIDR blocks for this subnet. The virtual network vnet-staging-01 (10.10.10.0/24) has /24 CIDR blocks of address space. This space is already taken by snet-staging-11 subnet (10.10.10.0/24). This is why there is no sufficient address space to create a gateway subnet and to establish a VNet-to-VNet VPN connection between two VNETs. We need to resize subnet space or create an additional IP address range for the gateway subnet.

For more information on configuring VNet-to-VNet connections, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-vnet-vnet-resource-manager-portal

Answer – A

The address spaces for the virtual networks don’t overlap. You can establish a peering connection between both virtual networks.

For more information on virtual network peering, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview

Answer – A

The address spaces for the virtual networks don’t overlap. You can establish a peering connection between both virtual networks.

For more information on virtual network peering, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview

Answer – B

If you look at an example of the default network security rules, only traffic inbound within the virtual network and traffic from the load balancer is allowed. Otherwise, all other traffic is denied. Hence here also the traffic will be denied.

For more information on network security groups, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/virtual-network/security-overview

Answer – A

Since there is a rule that allows remote desktop connections from any source, connections are possible into vmwhizlab2.

For more information on network security groups, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/virtual-network/security-overview

Correct Answer - B

The reason, since we have created a Windows VM, for security reasons the RDP port is by-default disabled in both virtual machines

• In the given scenario, we are creating a new NSG called nsg-whizlab1, and it does not have an RDP port added to it. We need to get it added by creating a new rule.
• you cannot connect to an Azure Windows virtual machine (VM) because the Remote Desktop Protocol (RDP) port is not enabled in the network security group (NSG).

Due to this reason "remote desktop" to vmwhizlab1 from vmwhizlab2 is not possible.

Hence,  B is the correct answer. 

Reference: Cannot connect to Azure VMs because the RDP port is not enabled in NSG - Virtual Machines | Microsoft Learn

Answer — C

The Recovery Services Vault(RSV) should be in the same region, in which VM's exist, in order to back up the VM's. RSV vaultwl2090, vmwl1, vmwl3, vmwlA and vmwlC  are in same region — Western Europe .  

It is clear that C is the right answer and all other answers are incorrect. 

Kindly note that Resource Group (RG) g-wl-01 and rg-wl-02 are in Western and Northern Europe respectively. VM  vmwl1 and vmwl3 are in RG rg-wl-01 and rg-wl-02. RG can be in different regions because they contained only metadata about the resources, not the actual resource. 

For more information on backing up Azure virtual machines using the Azure backup feature, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/backup/backup-azure-vms-first-look-arm

Answer - D

The network interface needs to be created in the same region as the virtual network.

Below is an excerpt from the Microsoft documentation on the creation of a network interface.

Since this is clear from the Microsoft documentation, all other options are incorrect.

For more information on network interfaces, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface

Answer – A

The Azure Import/Export service supports only data export from Azure Blob storage.

The Microsoft documentation mentions the following.

Since this is clear from the Microsoft documentation, all other options are incorrect.

For more information on the Azure Import/Export service, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/storage/common/storage-import-export-service

Answer – B

In this task, there are three types of resources that require a backup. One of them is the Azure SQL database. We don't need to create a daily backup for Azure SQL Database because Azure provides a backup as an automatic service for every database by default. Azure SQL Database is Azure fully managed platform-as-a-service (PaaS) database engine. It includes automatic patching, monitoring, and backups.  Azure SQL Database service is different from SQL Server that runs in Azure VM. SQL Server in VM requires the user to provide database maintenance and set up backups.

For two other types, Azure VM and Azure File shares, we need to create daily backup policies. For multiple VMs, Microsoft recommends creating a Recovery Services vault and add backup policies from the Backup policies option.

When we push the "Add" button, the following policy types are available for us to choose from.

So, we can create two daily backup policies: one for all our Azure virtual machines and one for all Azure file shares. 

All other options are incorrect.

For more information on an example of using the Azure backup service, please visit the following URLs-

• https://docs.microsoft.com/en-us/azure/backup/backup-azure-vms-first-look-arm
• https://docs.microsoft.com/en-us/azure/backup/backup-afs
• https://docs.microsoft.com/en-us/learn/modules/backup-restore-azure-sql/2-protect-database-with-backup

Answer – C

The storage account must be in the same region as the Recovery Services vault to store the reports. This is why storewl2090 is the correct answer.

The example below shows the configuration of the diagnostics setting for a vault. When we are selecting the "Archive to a storage account" option, the portal automatically takes the location of the recovery services vault. It limits us to storage accounts that are in the same region as the Recovery Services vault.

All other options are incorrect.

For more information on configuring Azure Backup reports, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/backup/configure-reports

Answer – D

The Log Analytics workspace can be in any region. It does not need to be in the same region as the recovery services vault.

Below is an example screenshot of choosing a Log Analytics workspace as part of the Diagnostic setting. Here the recovery services vault is in the Central India region. But the Log Analytics workspace is in the Central US region.

Since this is clear from the implementation, all other options are incorrect.

For more information on configuring Azure Backup reports, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/backup/configure-reports

Correct Answers: A, C and F

For better management of the various organization entities, Azure AD provides the Administrative units' functionality. The administrative units are the containers that include Azure AD objects, groups, and users that are localized within the unit's boundaries. You can define the administrative roles to manage users and their access only within the administrative unit. You need to have an Azure AD Premium license for the unit's administrators. For the users, you use the free Azure AD license.

You can create administrative units using Azure AD portal blade, PowerShell, and Microsoft Graph.

On the Azure Active Directory blade (Number 1), you select the Administrative Units item (Number 2). Then, on the Administrative units screen, you can add a new unit (Number 3) or select the units from the table (Number 4) for editing.

There are several built-in roles that Azure AD defines for the units. You can review them when you open the unit (Number 1) and select the Roles and administrators (Number 2). The new screen presents the table with built-in roles to assign to the unit’s users (Number 3).

In the case of the PowerShell, you need to use the New-AzureADMSAdministrativeUnit command. And for Microsoft Graph API, you post the HTTP Request: POST /directory/administrativeUnits to create a new unit.

• Option B is incorrect because you can use the Microsoft Office Admin center for the users' management, but not for creating the administrative units.
• Option E is incorrect because the Azure CLI does not have the functionality to create and manage administrative units.

For more information about Azure AD administrative units, please visit the below URLs:

• https://docs.microsoft.com/en-us/azure/active-directory/roles/administrative-units
• https://docs.microsoft.com/en-us/azure/active-directory/roles/admin-units-manage
• https://docs.microsoft.com/en-us/graph/api/administrativeunit-post-administrativeunits?view=graph-rest-1.0&tabs=http

Correct Answer: B

For better management of the various organization entities, Azure AD provides the Administrative units' functionality. The administrative units are the containers that include Azure AD objects, groups, and users that are localized within the unit's boundaries. You can define the administrative roles to manage users and their access only within the administrative unit. You need to have an Azure AD Premium license for the unit's administrators. For the users, you use the free Azure AD license.

To add the list of users to the administrative unit, you need to use the bulk operations. Only the Azure AD portal provides the bulk operation functionality. On the administrative unit blade (Number 1), you select the Users (Number 2). Next, you can choose one of the Bulk operations (Number 3) options. If you select the Bulk add members, the portal opens a new panel to the right with the steps to add the unit's members (Number 4). After you add the list, you can monitor and verify the results using the Bulk operation results screen (Number 5).

You can provide a prepared CSV list with the employees or download the template and create such a list. You need to keep the first two rows intact (Number 1) and add the members after.

You can remove the unit's members using the CSV list as well. You need to select the “Bulk remove members” option and supply the list.

• Options A, C, and D are incorrect because Microsoft Office Admin center, Microsoft Graph, and PowerShell can manage individual users in the administrative units but not the list of the users in a bulk manner.
• Option E is incorrect because the Azure CLI does not have the functionality to create and manage administrative units.

For more information about the management of the Azure AD administrative units, please visit the below URLs:

• https://docs.microsoft.com/en-us/azure/active-directory/roles/administrative-units
• https://docs.microsoft.com/en-us/azure/active-directory/roles/admin-units-add-manage-users

Correct Answers: A, C and E

Azure Monitor Insights for Networks brings several diagnostics and monitoring tools under one roof. It includes the following components:

• Network health and metrics — provides the integrated view of the networking resources' health, metrics, and alerts. Users can filter resources by subscriptions, resource group, and type.
• Connectivity — provides insights into the Connection Monitor tests. Test Information is divided into two categories: Sources and Destinations. Users can filter resources by subscriptions, resource group, source and destination types, and reachability criteria.
• Traffic — provides information about all NSGs and their Flow logs and Traffic Analytics configurations.

There is an additional set of the tools — Diagnostics Toolkit. It helps to troubleshoot the networks. The toolkit includes the following services: Capture packets on virtual machines, Troubleshoot VPN, Troubleshoot connectivity, Identify next hops, Diagnose traffic filtering issues.

You can examine the main network monitor components on the Monitor Networks screen (Number 1) by selecting the Networks (Number 2) item in the Insights section. There are three tabs: Network health (Number 3), Connectivity (Number 4), and Traffic (Number 5). On the first tab, you can review the health of the networking resources. When you click on the resource panel buttons (Number 7), the portal opens the table with the details on the bottom of the screen (Number 8).

If you need access to the diagnostics tools, click on the Diagnostics Toolkit dropdown (Number 6).

All other options are incorrect.

For more information about the Azure Monitor Insights for Networks, please visit the below URLs:

• https://docs.microsoft.com/en-us/azure/azure-monitor/insights/network-insights-overview
• https://channel9.msdn.com/Shows/Azure-Friday/Get-a-unified-network-monitoring-experience-with-Network-Insights

Answer – A

When configuring MFA to a user we need to provide valid options to validate the action. 

In the given table, wlusr2 does not have a valid mode of getting MFA request approved i.e., neither Office Phone / Mobile Number is provided for validating.  For this reason, by providing Mobile Phone Number MFA request can be validated.

In the given table, wlusr4 already has an Office Phone assigned, and that is enough for validating MFA in case if the user is working from Office.  If the user is working remotely, then MFA validaiton fails and for that adding a Mobile Phone Number will allow the login successful.

Due to these reasons, the answer is Yes.

For more information on Azure MFA, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks

Answer - A
The premise given here is for all the users and this question is asking if "adding" of "office phone number" to wlusr2 will allow MFA assigned? 

And this is possible, reason in order to configure MFA we need to have a valid contact number and in this case we are adding "office phone number".  The authentication call will be coming on the given phone number before authorizing the user.

For more information on Azure MFA, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/active-directory/user-help/multi-factor-authentication-setup-office-phone
• https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks

Answer – A

Yes, since MFA can't be enabled for external user accounts. Even if MFA is enabled for all users, it is not enabled for the external accounts. User wlusr3 has type "Guest" in Azure AD. To force wlusr3 to use MFA, we have to create a new user account for him in Azure AD.

Suppose you invite an external user, and then you go to the MFA settings page, you will not select the user to enable MFA.

If we implement the Conditional Access option, we would not be required to add this user to Azure AD. Conditional Access will force wlusr3 to use MFA.

For more information on Azure MFA, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks

Answer – D

The Microsoft documentation clearly states, that the replication type of the storage account, can be changed to Zone redundant storage, only, if the current replication technique is either LRS or GRS.

Hence, D is the correct answer and all other answers are wrong. 

For more information on migrating the replication technique, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/storage/common/redundancy-migration?tabs=portal

Answer – B

Kubernetes cluster can have vnet connectivity in two ways 

• Kubenet (By default)
• Azure CNI interface by choice 

Deployment of AKS cluster is always in a vnet, with multiple pods in separate subnets of the same vnet. Pods in an AKS cluster run on node, which is invariably an Azure VM. 

With kubenet, each of AKS nodes get an IP address from the subnet range, but pods get an IP address from an overlay network. Such IP addresses  are from a logically different IP address space outside vnet range. 

Such IPs are is not routable outside the vnet/subnet. For example, pods can talk to a DB, which is out the vnet/subnet, only via an additional hop, which will be the IP address of the node/Azure VM. Kubenet has some other disadvantages like:

• It does not support window containers.
• It does not support network and security policies definition from a centralized control plane.
• Additional user-defined routes (UDRs) lead to additional admin overhead.
• Extra hop has minor adverse effect on network performance 

With Azure CNI, every pod gets an IP address from the subnet range. Such IPs are routable, outside the vnet/subnet range, without requiring any extra hop.

CNI stands for container networking interface. CNI is an open standard for Kubernetes network plugin. With AzureCNI has the following advantages: 

• Pods get full virtual network connectivity and can be directly reached via their private IP address from connected networks. No additional hop is required.
• It supports window containers
• It provides centralized control for security and network policy

In view of above,  B is obviously the correct answer as kubenet meet the requirements of cluster A. All other answers are wrong. 

Azure CNI details are given below: 

For more information on networking in Kubernetes, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/aks/configure-kubenet

Answer – C

Kubernetes cluster can have vnet connectivity in two ways 

• Kubenet (By default)
• Azure CNI interface. 

AKS cluster can be deployed in a vnet with multiple pods in separate subnets of the same vnet. Pods in an AKS cluster run on a node, which is invariably an Azure VM.  With kubenet each of the AKS nodes gets an IP address from the subnet range. Such IPs are routable outside the vnet/subnet without requiring any extra hop... However, pods get an IP address from an overlay network. Such IPs are is not routable outside the vnet/subnet. For example, Pods can talk to a DB, which is out the vnent/subnet, only via an additional hop which will be the IP address of the node/Azure VM. This has an adverse effect on network performance. 

Kubenet has some other disadvantages like

• It does not support window containers.
• It does not support network and security policies definition from a centralized control plane.
• additional routes have to be manually managed and maintain for user-defined routes (UDRs)

CNI stands for container networking interface. CNI is an open standard for the Kubernetes network plugin. With Azure, CNI has the following advantages over Kubernetes

• Pods get full virtual network connectivity and can be directly reached via their private IP address from connected networks. No additional hop is required.
• It supports window containers
• It provides centralized control for security and network policy

So, C is obviously the correct answer.

For this requirement, the AKS clusters can use the Azure Container Networking Interface. This is also given in the Microsoft documentation.

So based on the documentation, all other options are incorrect.

For more information on networking in Kubernetes, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/aks/configure-kubenet

Answer – C

You can deploy a DotNet Core applications on either  Window OS or a Linux OS. Web apps and service plans should also be in the same region. 

Wlapp1, wlplanA and wlplanB are in East US region. 

In view of this. C is the correct answer and all other answers are wrong. 

If we want deployment in a pre-defined region, This is same as moving a web app to this region, the Microsoft documentation mentions the following.

Because of this reasoning, all other options are incorrect.

For more information on the Linux App Service Plan, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/app-service/overview-hosting-plans
• https://docs.microsoft.com/en-us/azure/app-service/app-service-plan-manage
• https://docs.microsoft.com/en-us/azure/app-service/containers/app-service-linux-intro

Answer – B

An ASP.NET v4.8 application CANNOT be deployed to Linux in Azure. Below is the screenshot from the Create Web App screen in Azure Portal.

As you can see Linux option is disabled.

All other options are incorrect.

For more information about App Service Plans and Web Apps, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/app-service/overview

Answer – B

To deploy an application to the cluster, you have to use a Kubernetes manifest file. This YAML file contains information about which ACR image to run. Then you can use kubectl apply command to deploy the application to the cluster.

An example of this is provided in the Microsoft documentation.

All other options are incorrect.

For more information on working with Kubernetes, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/aks/kubernetes-walkthrough

Answer – D

To work with Log Analytics data, you need to use the Kusto Query language (KQL).

An example of this is also given in the Microsoft documentation.

Since this is clearly mentioned in the documentation, all other options are incorrect.

For more information on working with queries in Azure Monitor, please visit the following URLs-

• https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/get-started-queries
• https://docs.microsoft.com/en-us/learn/modules/analyze-infrastructure-with-azure-monitor-logs/3-create-log-queries

Answer – A

Yes, since this is an isolated resource, so it can be moved to the resource group.

For more information on moving Azure resources, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/move-resource-group-and-subscription

Answer – A

The network interface can be moved to another resource group, even if it is part of an existing virtual network.  We do not need to move the associated resources of network interface along with it.  It is "optional" i.e., we can ignore moving of resources.  Below is the screenshot of the same.

Here is the screenshot of wlgrpA before we move wlnic1 to resource group wlgrpB.

And here are the Notification about the successful move and the screenshot of wlgrpB after the move.

Please do not confuse: you can attach resources with multiple resource groups.

For more information on moving Azure resources, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/move-resource-group-and-subscription

Answer – B

The location of the resource would remain as it is. It’s only the resource group that changes.

Here is the screenshot of wlgrpA before we move wlip1 to resource group wlgrpB.

And here are the Notification about the successful move and the screenshot of wlgrpB after the move.

For more information on moving Azure resources, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/move-resource-group-and-subscription

Answer - C

The maximum possible number of fault domains in an availability set is 3. Since we have to ensure that the maximum possible number of virtual machines are available when the fabric fails, we need to choose the value of 3.

The Microsoft documentation mentions the following.

Since this is clearly given in the Microsoft documentation, all other options are incorrect.

For more information on availability sets, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/virtual-machines/windows/manage-availability

Answer – C

First, we have to ensure that the maximum possible number of virtual machines are available when the fabric fails. We need to choose the value of 20. The maximum number of fault domains possible in an availability set is 3.

The Microsoft documentation mentions the following.

All other options are incorrect.

For more information on availability sets, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/virtual-machines/windows/manage-availability

Answer – D

Managed identities are identities created by ARM (Azure Resource Manager) and assigned to the resource for which it is enabled. The big advantage of managed identity is that its life cycle is tightly coupled with the resource. When a resource is deleted the corresponding Manage Identity is also deleted. This means a security admin will not have to maintain Managed Identity. 

Since WlAppA uses Managed Identity, WlAppA can access the Storage Account via IAM. As per requirement, we need to minimize the number of secrets used, so Access keys are not ideal in this scenario.

Option A is incorrect since this is used to enable or disable Cross-Origin Resource sharing.

Option B is incorrect We use this option to have an authorized access to the storage account created, and in this scenario, we are working with managed identities. So no need for access keys for authorized acess.

Option C is incorrect since this is required to provide access to the storage account's resources for a specified period of time.

Option D is correct since we need to minimize the use of secrets. Hence, we can use the Managed Identity to access the Key vault to get the storage account keys' values.

For more information on working with access keys, please visit the following URL:

• https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview 

Answer – C

Here we need to provide time-bound access. We need to make use of Shared Access Signatures.

The Microsoft documentation mentions the following.

Option A is incorrect since this is used to enable or disable Cross-Origin Resource sharing.

Option B is incorrect since this does not provide time-bound access.

Option D is incorrect since we need to minimize the use of secrets. Hence, we can’t use the Managed Identity to access the Key vault to get the storage account keys' values.

For more information on Shared Access Signatures, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/storage/common/storage-sas-overview

Answer - B

Availability sets can’t protect virtual machines from a data center level failure. Availability zones protect VMs from the data center failure.

You need to distribute your virtual machines across three availability zones.

Here is what Microsoft documentation provides.

For more information on Availability sets, please visit the following URLs-

• https://docs.microsoft.com/en-us/azure/virtual-machines/windows/manage-availability
• https://social.technet.microsoft.com/wiki/contents/articles/51828.azure-vms-availability-sets-and-availability-zones.aspx

Answer – B

Since an Availability Zone consists of one or more than one datacenters, the answer is No. Because in the case of Availability Zone with only one datacenter, we can't ensure that at any point in time, two virtual machines are always available in the event of a datacenter failure. From the point of best design standards, it's always advisable to have the VMs spread across multiple availability zones.

For more information on Availability Zones, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/availability-zones/az-overview

Answer – A

Yes, this is the right approach. The Microsoft documentation mentions the following.

For more information on Availability Zones, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/availability-zones/az-overview

Answer – C

For an Azure Web App, you need to have an Azure App Service Plan in place. To minimize costs, you can have a single App Service Plan and link all the Azure Web Apps to that App Service Plan.

The Microsoft documentation mentions the following.

Options A and B are incorrect since you need to have an App Service Plan.

Option D is incorrect since this would be an expensive option.

For more information about App Service Plans, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/app-service/overview-hosting-plans

Answer – C

We are talking about an HTTP probe that requires a probe on a specified path in this problem. Because the relative path is /Temp, we need to ensure a file in this path on the virtual machines.

The Microsoft documentation mentions the following about HTTP based health probes.

All other options are incorrect.

For more information about health probes, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-custom-probe-overview

Answer – B

Since the policy Not allowed resource type is assigned at "Subscription" level, all the resource that belong to it will get impacted.  Due to this reason, virtual network cannot be created in wlgrpA resource group.

For more information on Azure policies, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/governance/policy/overview#assignments 

Note - for reference please find the screenshot on what Azure says while trying to create a virtual network in wlgrpA.

Answer – B

A policy is defined at the subscription level with a Deny permission on virtualNetworks. This becomes the permission rule for all resource groups in the subscription.

For more information on Azure policies, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/governance/policy/overview

Answer – B

The virtual machines need to be part of a virtual network. There is a policy definition not to allow virtual networks assigned to Staging Subscription, and since the "parent" is assigned this policy we cannot have a virtual network created, and since VNET is there, the creation of the virtual machine won’t be allowed in any of the resource groups.

For more information about Azure policies, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/governance/policy/overview

Answer – B

Even though wlvm1 is in the Stopped(deallocated) state, this would still count the total number of vCPU's in the region. Hence adding a virtual machine with 16 vCPUs would cross the limit on vCPUs for the region.

The Microsoft documentation mentions the following.

You can easily find the subscription limit of vCPUs for the region using, for example, the following PowerShell command for "West US" region: Get-AzVMUsage -Location "West US".

For illustration purposes, we used a subscription with the limit of 10 vCPUs for the West US region. We created two VMs: wlvm1 with 8 vCPUs and wlvm2 with 1 vCPU. We stopped (deallocated) wlvm1. 

When we tried to create wlvm3 with 8 vCPUs, Azure displayed an error message that we have a limit for 1 vCPU only: this is what left from our subscription limit of 10 vCPUs for the West US region.

For more information on Azure resource limits, please visit the following URLs-

• https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/azure-subscription-service-limits
• https://docs.microsoft.com/en-us/azure/virtual-machines/windows/quotas

Answer – A

Since the total number of vCPUs comes in the limit, one would be able to create a virtual machine of this size.

You can easily find the subscription limit of vCPUs for the region using, for example, the following PowerShell command for "West US" region: Get-AzVMUsage -Location "West US".

For illustration purposes, we used a subscription with the limit of 10 vCPUs for the West US region. We created two VMs: wlvm1 with 8 vCPUs and wlvm2 with 1 vCPU. We stopped (deallocated) wlvm1. 

We didn't have any problem creating wlvm4 with 1vCPU within our subscription limit of 10 vCPUs for the West US region.

For more information on Azure resource limits, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/azure-subscription-service-limits

Answer – A

We can provide the Storage File Data SMB Share Reader RBAC role for this level of access.

The Microsoft documentation mentions the following.

Since this is clearly given in the Microsoft documentation, all other options are incorrect.

For more information about Azure Active Directory authentication for Azure file shares, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-active-directory-domain-service-enable

Answer – D

We can provide the Storage File Data SMB Share Elevated Contributor RBAC role for this level of access.

The Microsoft documentation mentions the following.

Since this is clearly given in the Microsoft documentation, all other options are incorrect.

For more information about Azure Active Directory authentication for Azure file shares, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-active-directory-domain-service-enable

Answer – B

To create an Azure Bastion host, you need to have the AzureBastionSubnet created as part of the virtual network.

This is mentioned in the Microsoft documentation.

All other options are incorrect.

Reference: Tutorial: Deploy Bastion using specified settings: Azure portal | Microsoft Learn

Correct Answer – D

For this, we need to set the option for Require Multi-Factor Auth to join devices.

This is mentioned in the Microsoft documentation.

All other options are incorrect.

For more information about device management, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/active-directory/devices/device-management-azure-portal

Answer – A

The minimum number of backup policies required is "1" i.e., Option A reason using one single policy we can have a backup of 100 VMs and in our scenario, we have 2 VMs with a web application. Coming to the database, we do not need to define any policy. 

For more information on Azure backup for virtual machines, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/backup/backup-azure-manage-vms

Answer – A

Yes, you can. Even though the virtual machines and the Log Analytics workspace are in separate locations, you can still connect the virtual machines to the workspace.

For more information on collecting data into a Log Analytics workspace, please visit the following URL-

• https://docs.microsoft.com/en-us/azure/azure-monitor/learn/quick-collect-azurevm

Correct Answer: C

Azure Monitor Insights for Networks brings several diagnostics and monitoring tools under one roof. It includes the following components:

• Network health and metrics — provides the integrated view of the networking resources' health, metrics, and alerts. Users can filter resources by subscriptions, resource group, and type.
• Connectivity — provides insights into the Connection Monitor tests. Test Information is divided into two categories: Sources and Destinations. Users can filter resources by subscriptions, resource group, source and destination types, and reachability criteria.
• Traffic — provides information about all NSGs and their Flow logs and Traffic Analytics configurations.

There is an additional set of the tools — Diagnostics Toolkit. It helps to troubleshoot the networks. The toolkit includes the following services: Capture packets on virtual machines, Troubleshoot VPN, Troubleshoot connectivity, Identify next hops, Diagnose traffic filtering issues.

The Traffic tab focuses only on network security groups (NSG). There are two tools to troubleshoot the NSGs: Flow logs and Traffic Analytics. If you select the Networks item (Number 2) under the Insights section of the Monitor blade, the portal opens the Monitor Networks screen (Number 1). Then you can click on the Traffic tab (Number 3). This tab presents information about NSGs. You can click on the panel button (Number 5), and the portal opens the table with the NGSs' details on the bottom of the screen (Number 6). The table provides information about the configuration status of the Flow logs (Number 7) and Traffic Analytics (Number 8) for each NSG. You can filter the table’s entries using the predefined checkboxes (Number 4).

To enable the logs and analytics, you click on the signs in one of the columns: the Flowlog Configuration Status or the Traffic Analytics Configuration status. The portal opens a new screen for Flow logs Settings (Number 1). You can enable the logs (Number 2), select the log's version, and provide a storage account for the logs (Number 3) with the number of days for the blog retention. The same screen provides options for Traffic Analytics as well (Number 4). You can enable this service (Number 5), set the processing interval for Every hour or Every 10 minutes, and select the Log Analytics workspace.

All other options are incorrect.

For more information about the Azure Monitor Insights for Networks and Traffic component, please visit the below URLs:

• https://docs.microsoft.com/en-us/azure/azure-monitor/insights/network-insights-overview#traffic
• https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-nsg-flow-logging-overview
• https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics
• https://channel9.msdn.com/Shows/Azure-Friday/Get-a-unified-network-monitoring-experience-with-Network-Insights