1.

AZ-104 Exam Important Notes

2. All Azure resources connected to a VNet have outbound connectivity to the Internet
by default

3. For the LRS replication, the data in the storage account is automatically replicated
three times in the primary region and therefore the minimum number of copies of the
storage account would be “3”.

4. A sync group can only have one server endpoint per registered server at any given
time.
a. In Azure File Sync, a sync group can only have one server endpoint per registered server
at any given time. This means:
b. A single Windows Server (that has been registered with Azure File Sync) can only
synchronize one folder (server endpoint) with a specific sync group.
c. However, the same server can be a part of multiple sync groups, but each sync group
can only contain one server endpoint from that particular server.
d. Example:
e. If you have a server registered with Azure File Sync, and you add the folder C:\Data as a
server endpoint in a sync group, you cannot add another folder like D:\Data from the
same server to the same sync group. You can, however, add it to a different sync group.
f. This limitation ensures that a specific folder on a server syncs to only one Azure file share
(cloud endpoint) within a given sync group, avoiding potential conflicts.
5. A sync group can contain only one cloud point.
a. In Azure File Sync, a sync group can contain only one cloud endpoint. This means that
within a sync group, you can only synchronize data with a single Azure file share
(cloud endpoint).
Key Points:
b. One Cloud Endpoint: Each sync group is tied to one specific Azure file share,
meaning all server endpoints (which can be multiple) in that sync group will
synchronize their data to that single cloud endpoint.
c. Multiple Sync Groups: You can have multiple sync groups, each with its own unique cloud
endpoint (Azure file share). However, each sync group can only reference one cloud
endpoint at a time.
d. Example:
e. If you have an Azure file share called CorporateShare, you can create a sync group that
uses CorporateShare as the cloud endpoint. You could then have multiple server
endpoints from different servers pointing to CorporateShare, but those server endpoints
can only sync with that one specific share.
6. A sync group can contain multiple server endpoints. It can also have one or more
server endpoints in multiple sync groups
a. Breakdown:
b. Multiple Server Endpoints in a Sync Group:
c. A sync group in Azure File Sync can contain multiple server endpoints. This means you
can have several folders from different servers, or the same server synchronized to a
single Azure file share (cloud endpoint) within that sync group.
d. For example, you could have:
i. C:\Data from Server A
ii. D:\Projects from Server B
iii. E:\Reports from Server A
iv. All of these can be server endpoints in the same sync group, syncing their data to
one Azure file share.

e. One or More Server Endpoints in Multiple Sync Groups:

f. A server (or a registered server) can be part of multiple sync groups, and it can
have one server endpoint in each of those sync groups.
g. This allows for flexibility in managing how data is synchronized from that server to
different Azure file shares (cloud endpoints).
h. For example:
i. Sync Group 1: C:\Data from Server A → Cloud endpoint 1
j. Sync Group 2: D:\Projects from Server A → Cloud endpoint 2
k. Summary:
l. Multiple Server Endpoints: A sync group can contain multiple server endpoints from one
or more servers.
m. Multiple Sync Groups: A registered server can have one or more server endpoints in
different sync groups, each pointing to potentially different cloud endpoints.
n. This design provides a powerful way to manage and synchronize data across various
locations while leveraging Azure’s cloud storage capabilities.

7. “Live migration” is ONLY supported for storage accounts that use ‘LRS’ and ‘GRS’
replication.
a. Live Migration in Azure: Definition: Live migration refers to the ability to move Azure
resources, such as virtual machines or storage accounts, from one region to another or
from one replication type to another without downtime.

8. Tags applied to the resource group or subscription are not inherited by the resources.

a. However using Azure Policy, either built-in or custom-defined policy definitions, we can
assign tags to either a specific resource group or across a whole Azure subscription. Tags
can also be applied to existing resources with the new “Modify” effect and a “remediation
task”.

9. No one is given default access to the root management group in Azure, and Azure AD Global
Administrators are the only users that can elevate themselves to gain access. Once
they have access to the root management group, the global administrators can assign any Azure
role to other users to manage it.
10. You need to create a site-to-site VPN to Azure. Which four actions should
you perform in sequence?
a. First Action: Create a gateway subnet: The gateway subnet is part of the virtual
network IP address range that you specify when configuring your virtual network. It
contains the IP addresses that the virtual network gateway resources and services use.
b. Second Action: Create a VPN gateway: The virtual network gateway uses the gateway
subnet.
c. Third Action: Create a local network gateway: A local network gateway is a specific
object that represents your on-premises location (the site) for routing purposes. You give
the site a name by which Azure can refer to it, then specify the IP address of the on-
 premises VPN device to which you will create a connection. You also specify the IP
address prefixes that will be routed through the VPN gateway to the VPN device.
d. Fourth Action: Create a VPN connection: Create the Site-to-Site VPN connection
between your virtual network gateway and your on-premises VPN device.

[Link] load balancer is a “Basic” load balancer, and it should be noted here that this
supports Virtual machines in a single availability set.
a. The Basic Load Balancer in Azure supports virtual machines within a single
availability set. For scenarios that require more advanced features, cross-zone support,
or high availability across multiple availability sets, the Standard Load Balancer is
recommended.
12. To establish a connection between two virtual networks in Azure across different subscriptions, a
VNet-to-VNet connection is required. This type of connection necessitates the presence of
a VPN gateway in each VNet. Hence, the first step is to provision virtual network gateways.
[Link] allows Virtual Networks (VNets) in different subscriptions, even across
separate Azure AD tenants, to connect and enable VM communication, without
requiring resource movement between subscriptions.
a. Moving VNet1 to Subscription2 or moving VM1 to Subscription2 (options C and D) are not
necessary steps for establishing a connection between the two VNets. Azure allows for
network connections between different subscriptions, even if they are not associated with
the same Azure Active Directory tenant. This means that the VNets can be connected and
the VMs can communicate with each other across different subscriptions, as long as the
necessary network connections are in place.

14. NSG flow logs allow viewing information about ingress and egress IP traffic through a Network
security group. Through this, the IP addresses that connect to the ILB can be monitored
when the diagnostics are enabled on a Network Security Group.
[Link] private endpoints secure access to a container registry, deployment errors may
arise from permissions, image availability, or networking misconfigurations; ensuring
proper identities and permissions for the container instance is critical.

a. while a private endpoint connection allows secure access to the container registry over a
private network, it does not resolve all potential issues with deploying a container
instance. The error might be related to permissions, image availability, or networking
configuration rather than the absence of a private endpoint. Other issues like missing
Azure Container Instance permissions, registry access policies, or image tags could
prevent deployment.
b. A more appropriate solution would be ensuring that the container instance has the proper
permissions to pull images from the registry. This can be done by checking if the
container instance has the necessary identities (system-assigned or user-assigned) and
permissions to access the container registry.

16. in Azure, route tables (like RT1) can only be associated with subnets, not with virtual
networks (VNet1) or network interfaces (NIC1). When you associate a route table with a subnet,
all resources (like virtual machines) within that subnet use the custom routes defined in the
route table.

[Link] location of the virtual machine that is being added to the virtual machine scale
set (VMSS1) should be in the same region as the location of the VMSS1

[Link] in an availability set are spread across 3 fault domains by default

[Link] EXPORT job allows data to be exported ONLY from the BLOB storage.

20. A Recovery Services vault is a management entity that stores recovery points created over time
and provides an interface to perform backup-related operations. Please note that when you
select the geographic region for the vault to protect any data source, the vault must
be in the same region as the data source.
21. To inspect all network traffic from VM1 to VM2 for three hours, you can use Network
Watcher's packet capture feature, which collects and analyzes traffic data between the virtual
machines.
[Link] Connection Monitor (a feature of Network Watcher) provides regular insights into
communication between VMs and endpoints, including details on reachability, latency,
topology changes, and average round-trip time in milliseconds.

23. Peering connections should be established between various virtual networks so that
the virtual machines in the various VNETS can communicate with each other. The only
solution to the requirement is to configure the “VNET peering”.
24. What is the maximum number of virtual machines that can connect to Subnet1? [Link]/25
a. The maximum number of virtual machines that can connect to a [Link]/25
subnet is 123, as Azure reserves 5 of the 128 IP addresses for internal use.
b. The subnet [Link]/25 has a total of 128 IP addresses. However, Azure reserves the
first four and the last IP address in every subnet for internal use. Therefore, the available
IP addresses for virtual machines are:
c. 128 (total IP addresses) - 5 (reserved addresses) = 123 usable IP addresses.
d. These 123 addresses can be assigned to virtual machines or other resources within the
subnet.
e. [Link]/25 means the subnet has 128 total IP addresses (2^7 = 128).
f. Azure reserves five IP addresses in each subnet:
g. The first IP is the network address.
h. The second through fourth IP addresses are reserved for Azure services.
i. The last IP address is reserved for the broadcast address.
j. Thus, 123 addresses remain available for virtual machines.
25. App Service Plans are created as per the Operating System type (mainly “Windows”
or “Linux”) and if the runtime stack is supported on the given Operating System, we can
create one app service plan for each of the OS.

26. You receive a notification that VM1 will be affected by maintenance. You need to move VM1 to a
different host immediately.

a. From the Redeploy + reapply blade, you click Redeploy.

27. You need to create an alert in Azure when more than two error events are logged to the System
event log on VM1 within an hour.
a. To create an alert in Azure for when more than two error events are logged to the System
event log on VM1 within an hour:
i. Set up an Azure Log Analytics workspace and configure the data settings to
collect the System event logs.
ii. Install the Microsoft Monitoring Agent (MMA) on VM1 to send logs to the Log
Analytics workspace.
iii. Create an alert in Azure Monitor, using the Log Analytics workspace as the
source, and configure a query to trigger when the specified condition (more than
two error events in an hour) is met.

[Link] and file only these are supported using the “AzCopy” command.
29. There is no limit on the number of App service plans of the premium tier in a single region. You
can deploy 100 App service plans in a single resource group which is kind of a limit but on the
scope of a resource group. For free tier App service plans, there is a limit of 10 App Service plans
in a single region though.

30. single VM cannot be protected/backed up by two Recovery service vaults at the same
time. Therefore, If you need to enable backup for VM2 in RSV2, you would need to remove the
backup first from RSV1.

[Link] now also supports Entra ID along with Share/Directory level SAS authorization
while moving the files.

[Link] uses the Azure AD client application to sign the users with OAuth 2.0 device
authorization.

33.“Expiration policy” can be set ONLY for “Office 365 groups”

[Link] resources that generally cannot be moved between subscriptions. Basic all
services can be moved between subscriptions though.
a. Azure Active Directory (Azure AD), Azure DevOps Resources, Reserved IP Addresses,
Azure Government Subscriptions, Classic Resources
b. Some Resource Providers, Subscriptions and Resource Groups, Some Networking
Resources, Managed Disks (under specific conditions), Azure Key Vaults
35. We cannot delete a resource group if the backup is enabled. Therefore, we first need to
stop the backup if anything is in place and then try to delete the resource group.

[Link] Files only can give a “persistent storage” for “containers”.

37. By default, Global Administrators in Azure AD and the device owners are automatically
granted local administrator rights on Azure AD-joined devices (e.g., Computer1). This allows
them to manage the device directly without additional configuration.

38. In order to peer virtual networks, the first criterion is that they should have “non-overlapping” IP
addresses.
a. Example of Non-Overlapping IP Addresses for VNet Peering:
b. VNet1 Address Space: [Link]/16
Contains IP addresses from [Link] to [Link].
c. VNet2 Address Space: [Link]/16
Contains IP addresses from [Link] to [Link].
i. These address spaces are non-overlapping, so VNet peering between VNet1
and VNet2 is allowed.
ii. Counter Example (Overlapping IP Addresses):
1. VNet1 Address Space: [Link]/16
2. VNet2 Address Space: [Link]/24
d. Since both VNets share IP addresses from [Link] to [Link], their address spaces
overlap, and peering between them is not allowed.

39. auto-shutdown does not affect the backup schedule or eligibility of virtual machines for
Azure Backup.

a. The first point to note here is that “auto-shutdown” values do NOT affect the Azure
backup of virtual machines. This implies that the Azure backup will take backup of the
 VMs irrespective of whether they are running or if they have any “auto-shutdown” values.
Also Azure backup supports Windows and Ubuntu OS and therefore all of the above
virtual machines are eligible for Azure backup.
40. When deploying a template from the Azure Resource Manager (ARM) template library, you only
need to specify the resource group where the resources will be deployed. All other
configurations, such as resource types, settings, and parameters, are automatically defined
within the template itself and are not manually adjusted during deployment. This means that the
deployment process simplifies resource provisioning by allowing you to choose the resource
group while inheriting all other configuration details from the template.

[Link] hosting a Web App, the App Service Plan should be in the same location
42. In this case, since both VMs are in the same subnet and the request is being initiated internally
(from VM1 to VM2), you do not need to define inbound rules. Instead, you only need to create an
outbound rule that allows VM1 to ping VM2. This outbound rule should be configured with the
least privilege principle in mind, allowing only the necessary traffic from VM1's IP address to
VM2's IP address, and it should have a lower priority to avoid conflicting with other rules.

43. The Storage Account Key Operator Service Role grants the necessary permissions to
list and regenerate storage account keys without providing broader access to the
storage account's data. This role is specifically designed for key management tasks, allowing
the user to perform actions related to storage account keys.

44. A source storage account can only replicate to two destination accounts at a time.
a. A source storage account in Azure can only replicate its data to two destination storage
accounts at a time. This limitation ensures that data replication is managed efficiently
and avoids potential conflicts or overloading of resources. If you need to replicate to
more than two destination accounts, you would need to configure separate replication
processes for each set of destination accounts.

45. BLOB storage is the only storage that supports both the “Import” and “Export” in an
Azure Import/Export service.

46. Requirements can be handled by “Zone Redundant Storage” which is applicable only to the
“General-purpose v2” storage account (i.e) “StorageV2”. This is because in ZRS data is copied
across three availability zones making the data available even if a single data center in the
region fails.
a. Zone Redundant Storage (ZRS) is a feature available only for "General-purpose v2"
storage accounts (StorageV2) in Azure. ZRS ensures high availability by replicating data
across three availability zones within a region, providing resilience in case one data
center fails. This redundancy helps to maintain data availability and continuity, making it
suitable for scenarios where business continuity is critical, as the data remains accessible
even if one zone experiences an outage.

47. Resource locks are used to lock a subscription or an Azure resource so that other users will
not accidentally modify or delete them.
48. In Azure, a Point-to-Site connection cannot be established with a policy-based VPN gateway.
Therefore, to set up such a connection, you must delete the existing policy-based gateway and
create a route-based virtual network gateway instead. A route-based VPN gateway is the
 correct type to use for establishing a Point-to-Site connection, as it supports dynamic
routing and can handle the secure connection between the client and the Azure virtual network.

[Link] need to remove the dynamic Public IP and assign a static and standard Public IP
in order for it to connect to a standard Load balancer.
a. To connect to a standard Load Balancer in Azure, you need to remove the dynamic Public
IP assigned to the resource and replace it with a static and standard Public IP. This is
because Azure's standard Load Balancer requires a static Public IP to ensure stable and
consistent routing. A dynamic Public IP does not meet the requirements for use with a
standard Load Balancer, as its address may change over time.

[Link] allows to define the traffic rules based on which VMs will be accepting the traffic.

51. IP flow verify checks if a packet is allowed or denied based on 5-tuple information
(Source IP, Destination IP, Source Port, Destination Port, and Protocol) in the Network Security
Group (NSG) and firewall rules. It is designed to test and identify exactly the sort of issue
described in the question - a specific security rule that is preventing a network packet from
reaching a VM.

52. Connection troubleshoot enables you to test a connection between a VM and another
VM, an FQDN, a URI, or an IPv4 address. The test returns similar information returned when
using the connection monitor capability, but tests the connection at a point in time, rather than
monitoring it over time.

[Link] per the documentation, if no resource limit is specified, the container's maximum resource
usage is equal to its resource request. This means both container1 and container2 will only use
the CPU resources they request (2 CPUs for container1 and 3 CPUs for container2). By
removing the resource limits, container2 will not be able to consume more than its
requested 3 CPUs, and therefore will not negatively impact container1, which is
requesting 2 CPUs.
54. In Azure, deleting a resource group requires the removal of all associated resources.
To do so, administrators must first lift any locks that protect resources from being altered
or deleted, such as the delete lock on VNET1. Additionally, when deleting resources like a
Recovery Services vault, any backup data it contains must be deleted and moved to a
"soft deleted" state. Therefore, to delete the TestRG resource group, the necessary
first steps are to remove the delete lock from VNET1 and ensure all backup data in
Vault1 is deleted. Only after these steps can the vault be deleted, followed by the deletion of
the entire resource group.

55. The virtual machine instance lifecycle - creation, update, deletion - is managed by the
scale set. It is the current default VMSS behaviour. (Scale set VMs are created in a single shot).
56. VM3, which has IP forwarding, must be turned on, in order for VM2 to connect to
VM1. To enable VM2 to connect to VM1, IP forwarding must be turned on for VM3. This is
because VM3 acts as an intermediary, forwarding traffic between VM2 and VM1. Without IP
forwarding enabled on VM3, the traffic from VM2 to VM1 would not be routed correctly.

[Link] can only be associated with resources within the same region as the NSG.
58. We cannot make any changes to the address space of a VNet while it is connected
with a peering connection to another network. Hence, we need to delete the peering
 first, add the address space, and then recreate the peering. In Azure, you cannot modify the
address space of a virtual network (VNet) while it is connected to another network through a
peering connection. To make changes to the address space, you must first delete the existing
peering connection, update the address space, and then recreate the peering connection. This is
necessary to ensure that the network configurations are consistent and to avoid any disruptions
in the peering relationship.

[Link] can move any storage accounts across resource groups as long as they do not
have any private link connected to the VNet in the current RG. If there are private
link connections, these must be removed before the storage account can be moved to
another resource group.

[Link] can be moved across resource groups even when they are connected to a running
VM

61. Azure Public IPs are region specific and can't be moved from one region to another .
Hence the location of IP2 will remain the same as East US.

62. The Connection Monitor resource is region-specific, meaning that it can only monitor VMs
located in the same region where it's deployed
63. A standard Load balancer does not support VMs with basic Public Ips. A standard Load
Balancer in Azure does not support virtual machines (VMs) that are assigned basic Public IP
addresses. To use a standard Load Balancer, the VMs must be assigned with standard Public IP
addresses. This is because standard Public IPs are required for certain advanced features, such
as zone redundancy and better SLA, which are supported by the standard Load Balancer.

64.445 is the SMB port that facilitates the transfer of messages/files over the internet.

[Link] bastion allows you to connect to any VM in any of the peered networks if
connected to one of those VNets.

66. Routing preference is CORRECT because, with this option available for storage accounts, you
can choose how the traffic from the internet reaches your account. The default is
Microsoft global network, which allows your clients to access the storage account files from a
POP closest to their location.

[Link] recommends using the Storage V2 type of storage account for all scenarios
be it replication or archiving.

[Link] tool is supported by all three kinds of Operating systems be it Windows,

Linux, or macOS.

[Link] Azure Export/Import job directly connect with Azure blob or File storage services
to transfer the data.

[Link] can add only one Cloud endpoint to a sync group

[Link] can add multiple server endpoints in a sync group

[Link] order to add any server to the sync group, you need to register it first to the
group, and then only you can add it as a server endpoint.
[Link] App service plan of tiers Standard, Premium, and Isolated only support staging
slot. If the option of a deployment slot is not available, then we need to scale up the App
service plan by changing the tier to Standard, Premium, or Isolated.

74. VMSS makes use of placement groups that act as implicit availability sets having the default of 5
fault domains and 5 update domains. Hence during maintenance, each update domain will have
2 machines, and one domain will be updated at a time, hence leaving 8 machines up and
running.

75. Create a DNS record is CORRECT as you need a new record to point the DNS queries to the app
service and you can use either a CNAME record or an A record to map a custom DNS name to
App Service.

[Link] only way to change the VNet of a VM is to recreate the VM in that VNet.

77. All windows events’ logs are stored in Log Analytics workspace, and we would need to
run this alert against a log analytics query looking for specifically System events of error
category.

[Link] Load Balancer can only have Static IPv6 addresses of Standard SKU
attached to it. Basic Load Balancers on the other hand can connect only with Dynamic
IPv6 IPs and Basic SKUs.

79. All communications are allowed by default on all ports in the same virtual network
unless explicitly denied using NSG rules. And NSG1 which is attached to Subnet1 has only
one rule while NSG2 is not attached to any resource.

80. Azure backup service uses block blobs to store backup data, so BlobStorage type is
suitable for this scenario. In addition, to minimize latency and costs associated with
outbound data transfer, it is generally recommended to place backup data in the
same region as the resource being backed up.

81. When adding a route to a routing table and specifying a next hop IP address, the
correct next hop type is Virtual appliance. A virtual appliance refers to a Network Virtual
Appliance (NVA), such as a firewall or load balancer, which inspects or processes network traffic.
By choosing Virtual appliance, you can specify the IP address of the NVA that will
handle the routed traffic.

[Link] can only be created in the location in which we have our Virtual network

83.A file added to a Cloud endpoint takes around 24 hours to get synced to all the server
endpoints due to the change detection job which runs every 24 hours.

[Link] load balancer requires all the VMs that are added in the backend pool to be
residing in the same availability set or the VM scale set by design.

[Link] Load balancers, backend pool endpoint limitation states that all virtual
machines must be connected to a single virtual network.

86. Azure supports conditions in role-based access control (RBAC) for both Azure Blob Storage
(containers) and Azure Queue Storage
87. To manage outbound traffic from a virtual network using Azure Firewall, you first need to
create a route table. This route table will define the paths that network traffic will
take. In this case, you would configure the route table to use Azure Firewall as the next
hop for the traffic leaving the VNet. This way, the Azure Firewall can inspect and filter outbound
traffic.

88. the Microsoft Defender for Cloud Apps Discovery license was not enabled for Group1.
Even though User1 is a member of Group1, User1 will not be assigned the Microsoft Defender for
Cloud Apps Discovery license because it is not part of the licenses assigned to Group1.

[Link] Standard Load Balancer only supports public IP addresses with a Standard SKU

90. Azure Storage Explorer provides functionalities to upload blobs to a container, create a file share
in a storage account, and add data to a storage table. However, Azure Storage Explorer does
not have the capability to create a new storage account. For that, one needs to use the
Azure portal or Azure CLI or Azure PowerShell.

91. Azure Monitor Network Insights provides a comprehensive and visual representation
through topologies, of health and metrics for all deployed network resources, without
requiring any configuration. It also provides access to network monitoring capabilities like
Connection Monitor, flow logging for network security groups (NSGs), and Traffic Analytics. And it
provides other network diagnostic features.
92. Network Watcher requires this agent to be installed in the on-premise servers in
order to be able to correctly map the network metrics between local and Azure
network. Network Watcher requires the installation of a specific agent on the on-
premise servers to collect accurate network metrics and enable proper mapping between the
local network and the Azure network. This agent helps Network Watcher monitor and analyze the
connectivity, performance, and other metrics for a seamless integration of on-premise and Azure
network environments.

[Link] Storage supports up to 5 stored access policies per container

94. Azure Storage allows up to two immutable blob storage policies per container: one
Legal Hold policy and one Time-based Retention policy. The Legal Hold policy is used to preserve
data for legal purposes, while the Time-based Retention policy ensures that data is retained for
a specified period and cannot be modified or deleted during that time. These two policies can be
applied simultaneously to a container, providing both legal and time-based data retention
guarantees.
95. Azure uses TXT records to verify domain ownership. Azure uses TXT records as part of the
domain verification process when you add a custom domain to services like Azure Active
Directory or other Azure services.
a. When setting up a custom domain, Azure will provide a unique TXT record that needs to
be added to the DNS configuration of your domain. This TXT record helps verify that you
own the domain and allows Azure to complete the domain setup process. Once the
record is added and propagated, Azure can verify the ownership and proceed with the
configuration.
b. Choosing the Right DNS Record:
 i. Use A or AAAA when you want to point a domain/subdomain to a specific
server’s IP address.
ii. Use CNAME when you want to alias one domain to another, often for subdomains
or for SaaS integrations.
iii. Use MX when configuring email for the domain.
iv. Use TXT for additional domain verification, email security, or service-specific
configurations.
v. Use SRV for service-specific configurations like SIP or XMPP.
vi. Use NS for defining authoritative DNS servers for a domain.
vii. Use PTR for reverse DNS lookups or email authentication.
viii. Use CAA to limit which certificate authorities can issue certificates for your
domain, enhancing security.
ix. Use ALIAS or ANAME for root domain mapping when CNAME records are not
allowed.

96. We can use 1 service endpoint for all storage accounts deployed in the same region.
Apart from this, the service endpoint is not needed for Azure AD, because VMs accessing Azure
AD users (e.g., for user management, authentication, or authorization purposes) relies on Azure
AD's authentication and authorization mechanisms, and it doesn't require a service endpoint.
Azure AD is a cloud-based identity and access management service that operates independently
of a VNet's service endpoints.

[Link] enable multi-user authorization (MAU) for a Recovery Services vault in Azure, you
need to create a Resource Guard first.

98. Azure Firewall currently only supports IPv4 addresses. Both IP1 and IP2 are IPv4
addresses with a Standard SKU, which is required for Azure Firewall. The tier (Regional or Global)
does not affect the ability to use the IP address with Azure Firewall.

99. Azure only allows to add co-administrators on the subscription scope.

100. Azure Bastion, be it standard or basic, only supports Standard Public IP addresses.

101. By default, the routing method is set to be through Microsoft global network. But this
configuration sometimes increases the network costs if the data you are trying to access is in
another region, and in order to reach your system it has to traverse through Microsoft global
network to a great extent. In order to minimize this, you can change to Internet routing
where it is passed on to the transit ISP at the earliest opportunity.

102. With LRS type of redundancy you get 3 copies of the data spread in 3 different
zones/datacenters of the region.

103. How should you configure DC1 for IP address?

a. Obtain an IP automatically

104. They are the preferred choice for encrypting virtual machine disks because they provide a
balance of security, control, and compliance. With CMKs, you can meet all of the specified
requirements, including storing and managing keys in Azure Key Vault, maintaining
encryption during downloads, and encrypting both OS and data disks.
105. You can perform a migration, you need to set up the infrastructure and processes for
replicating, converting, and staging your VMs for migration to Azure. Deploying the OVA
template is part of this preparation and is usually one of the first steps in the
migration process.

106. Setting up an Azure Monitor Private Link Scope is usually the initial step when
configuring private access to Azure Monitor. It defines the scope and configuration for
private communication between your resources and Azure Monitor.

107. Azure AD licenses can only be assigned to security groups and Microsoft 365
groups, but not to mail-enabled groups, because then you would not be able to manage the
membership dynamically.

108. Azure Container Instances (ACI) supports both Linux and Windows containers, but Azure
Container Apps only supports Linux containers.

109. Azure firewall can connect to a virtual network in the same region and also in the
same resource group. It cannot connect with the VNet in another resource group even if it is
in the same region.

110. end to a Log Analytics workspace allows you to send diagnostic logs and metrics to an Azure
Monitor Log Analytics workspace. Log Analytics is a powerful platform for collecting, analyzing,
and visualizing data from various Azure services, including Azure SQL databases. It provides
advanced query capabilities using the Kusto Query Language (KQL), which allows you to
create custom queries to analyze log data, set up alerts, and create custom dashboards.

111. Azure blob container can only be backed up in Azure Backup vault as it supports
Azure blob storage service. Azure Recovery service vault on the other hand does not support
Azure Blob storage.

112. once the file1 is moved to archive after 3 days, the modified date time remains the same.
Which means, after 5+ days for Rule 2, it will not be able to move it back to cool tier from
archive, as it needs to be rehydrated which cannot be done via a policy.

113. this storage account is of type StandardV2 which supports blob-level tiering. So individual blob
can have different tiers.

114. with Basic SKU, only 2 instances can be created. And each instance supports upto 40
SSH concurrent users. Hence in order to support 10 sessions, we need to upgrade the
SKU of the Bastion service to Standard which allows to define the number of instances you
need. We need at least 3 instances in this case.

115. support for native client is not supported by the basic tier of Bastion service. You need
Standard tier of Bastion to connect to a VM using [Link], which is a native RDP
client in Windows machines.

116. VM2 is in VNet2 which is directly peered to VNet1 and Bastion1 is deployed in VNet1.
Hence the connection can be easily made to VM2.

117. You need to ensure that when an NSG is created, it automatically blocks TCP port 8080
between the virtual networks.
 a. Solution: You configure a custom policy definition, and then you assign the policy to the
subscription.

118. site-to-site connection requires a gateway to be deployed in each connecting virtual

network

119. global peering is possible between VNets in different regions, provided these networks
do not have overlapping addresses.

120. global peering is possible for VNets in different regions as well as different
subscriptions provided these networks do not have overlapping IP addresses.

121. we cannot make a Point-to-site connection with a policy-based gateway in Azure.

Hence we must have to delete the existing gateway.

122. we need to establish a point-to-site connection using a gateway in Azure. And that can be
done only using a route-based VPN gateway.

123. In order for a public DNS zone to work correctly, it is crucial that the internet's top level
domain (TLD) DNS servers know where to route DNS queries for that specific zone. This routing
information is provided by the name servers configured at the domain registrar.

124. we need to remove the dynamic Public IP and assign a static and standard Public IP in
order for it to connect to a standard Load balancer.

125. Basic SKU doesn't allow flexibility in Availability Sets.

126. If all probes for all instances in a backend pool fail, no new flows will be sent to the
backend pool. Basic Load Balancer will terminate all existing TCP flows to the
backend pool.

127. IP flow verify checks if a packet is allowed or denied based on 5-tuple information
(Source IP, Destination IP, Source Port, Destination Port, and Protocol) in the Network
Security Group (NSG) and firewall rules. It is designed to test and identify exactly the sort of
issue described in the question - a specific security rule that is preventing a network packet from
reaching a VM.

128. az acr create command is used to create a new Azure Container Registry (ACR).
Once the container registry is created, you can push your container images (such as image1) to
the registry. This satisfies the requirement of provisioning a new Azure Container Registry.

129. Azure Container Instances does not support automatic scaling.

130. if no resource limit is specified, the container's maximum resource usage is equal to
its resource request.

131. You plan to set up Azure File Sync between Server1 and the Azure file share.

132. StorageV2 supports all three storage classes - Hot, Archive and Cold. Moreover, we need
to make sure the data in the storage account is replicated to another region to save from
regional failures.

133. Admin1 has enabled the higher authoritative access for himself across all subscriptions and
hence can manage the users in any of the subscriptions in the tenant.
134. Azure AD Administrators by default do not have managerial access to Azure subscription
unless explicitly defined. Hence Admin2 cannot do anything in the subscription. Cannot even see
it in the list of subscriptions

135. SSPR is enabled for all users (non-enterprise admins). But this regular SSPR policy does
not apply to Administrator roles in Azure AD. If the user has been assigned an admin role,
then he/she needs to go through a two-gate policy to reset his/her password. And also, the SSPR
is enabled for admin roles by default.

136. only FileStorage type of storage account supports Premium file share and cannot be deployed
on any other type of storage account.

137. tiering in a Storage account is supported by only two types of storage accounts - BlobStorage
and StorageV2. You cannot configure any other type of storage accounts like Storage,
FileStorage, etc.

138. Azure backup uses a policy to define the frequency and the type of backup for the virtual
machines. Hence we need to create a policy to start the backup.

139. we need to create a name server (NS) record for the zone in order to delegate the
subdomain to another DNS server.

140. Azure Blob storage provides data protection features such as soft delete, versioning, and
point-in-time recovery to help guard against accidental deletions and modifications. By
configuring the Blob service Data protection for storage1, you would be able to restore the data
in container1 for up to 90 days, meeting the given requirement.

141. TXT or MX is CORRECT as these records are used to verify the ownership of a
domain, which is required while adding a custom domain in Azure AD tenant.

142. the Usage location is an Azure property that can only be modified from Azure AD (for
all users including Windows Server AD users synced via Azure AD Connect).

143. you cannot change the VNet of a VM. The only way is to recreate the VM in the target VNet.

144. You need to deploy an Azure virtual machine scale set that contains five instances as quickly
as possible.

a. Deploy one virtual machine scale set that is set to ScaleSetVM orchestration
mode

145. You need to create a scheduled runbook to increase the processor performance of VM1 at the
end of each month. What task should you include in the runbook?

a. Modify the VM size property of VM1

146. You sign in to VM1 as a user named User1 and perform the following actions:
147. Create files on drive C.
148. Create files on drive D.
149. Modify the screen saver timeout.
150. Change the desktop background.
a. What task should you include in the runbook?
 b. D drive is a temporary storage drive which clears out all the content once the VM is
rebooted. And in the redeploy process, the VM is shut down, and deployed to a new host
in the datacenter. Hence all files on D drive will be lost.

151. with automaticOSUpgradePolicy, with a maximum of only 20% of the scale set and a
minimum of 1

152. the routing table allows connections from VM3 to VM1 and VM2. And as IP forwarding is
enabled on VM3, VM3 can connect to VM1.

153. Azure Internal Load Balancer (ILB) provides network load balancing between virtual machines
that reside inside a cloud service or a virtual network with a regional scope. Also, when we do
not need the VMs to be accessible from the internet.

154. the Azure DHCP service ignores any DNS suffix when it registers the private DNS
zone. For example, if your virtual machine is configured for [Link] as the primary DNS
suffix, but the virtual network is linked to the [Link] private DNS zone, the virtual
machine's registration appears in the [Link] private DNS zone

155. If you make a change to the topology of your network and have Windows VPN clients, the
VPN client package for Windows clients must be downloaded and installed again in
order for the changes to be applied to the client.

156. NSGs can only be associated with resources within the same region as the NSG

157. we cannot make any changes to the address space of a VNet while it is connected with a
peering connection to another network. Hence we need to delete the peering first, add the
address space, and then recreate the peering.

158. you can move any storage accounts across resource groups as long as they do not have
any private link connected to the VNet in the current RG.

159. NIC can be moved across resource groups even when they are connected to a
running VM. Hence NIC1 can be moved easily to RG2.

160. Azure Public IPs are region specific and can't be moved from one region to another.
Hence the location of IP2 will remain the same as East US.

161. we can create a new subnet in the VNet and then connect the Webapp1 to VNet1 using the
VNet integration feature in webapp settings.

162. You need to enable Desired State Configuration for VM1.

a. Start VM1 is CORRECT as the DSC extension for Windows requires that the target Virtual
Machine is able to communicate with Azure. First, you start the VM, because you need
the VM online to deploy DSC Extension.

163. the import of DNS file is supported via Azure CLI and Azure Portal at the moment. And since
you manage Azure subscription and Server1 from Server2 which already has CLI installed, it
would be the least effort to run the import using it.

164. Locks are designed for any update or removal. In this case, we want to move only, we are
not deleting, and we are not changing anything in the resource.
165. you can only attach virtual machines that are in the same location and on the same virtual
network as the load balancer. Virtual machines must have a standard SKU public IP or no
public IP.

166. we can use the same certificate from an already connected computer by exporting it and
importing it into the second computer.

167. Using a custom policy, we can define the rules for the network security group using
port ranges, priority, protocol, etc. When we define this in a custom policy and then assign it
to a subscription, it would take effect on the network security groups that are created in the
Azure subscription, and therefore using a custom policy we can block TCP connections
between VNETs on port 8080 (used by a network security group).

168. Connection Monitor resource is region-specific, meaning that it can only monitor VMs
located in the same region where it's deployed. Given the information that VM1, VM2, and VM3
are in the West US region and VM4 is in the Central US region, you would need to create two
Connection Monitors: one in the West US region for VM1, VM2, and VM3, and another one in the
Central US region for VM4.

169. the frequency you can choose while configuring backup for blob storage can be either
daily or weekly. So, among the options given, daily seems to be the most frequent one
possible.

170. you can take a maximum of 6 backups a day for Azure file share. So, in order to take as
many backups a day as possible, you should go for Every 4 hours as the backup
frequency.

171. Global Admins do not have permissions to assign custom security attributes to
Entra objects. even though Admin3 has the correct privileges, custom security attributes
cannot be assigned to Microsoft 365 groups.

172. Azure Disk Encryption requires a key encryption key (KEK) based on RSA for encrypting
virtual machines. Key1 is an RSA key with a size of 4096, which is supported for this purpose.
Azure Disk Encryption works for virtual machines that meet specific disk type and operating
system compatibility requirements:

a. VM2 uses Windows Server 2022 with a basic volume, which is compatible with
Azure Disk Encryption.

b. VM3 uses Red Hat Enterprise Linux with standard SSDs, which are supported by
Azure Disk Encryption.

173. Azure Storage accounts allow a maximum of five stored access policies(SAP) per
container. Since cont2 already has three stored access policies (Stored1, Stored2, and
Stored3), you can create two additional stored access policies to reach the limit of five.

174. In Azure Blob Storage, you can create up to four immutable blob stored access
policies per container. Since cont2 already has a legal hold configured, this consumes one of
the available policies, leaving you with the option to create one more immutable blob stored
access policy.
175. File shares can organize content using directories regardless of whether the storage account
supports a hierarchical namespace.

176. certificates are in the PKCS#12 format, which is the standard and supported format
for SSL/TLS certificates on Azure App Service, like WebApp1. PKCS#12 (often denoted as PFX)
is generally easier to use with Azure services that require secure communications, such as
WebApp1.

a. Cert3 or Cert4 are in the PEM format, which typically requires additional
conversion steps to be used for SSL/TLS certificates in Azure WebApp services. While
possible, it adds complexity and is not the best practice for the scenario.

177. Microsoft Entra tenants come with an initial domain name

like, [Link]. You can't change or delete the initial domain name, but
you can add your organization's name to the initial domain. By adding your custom domain
name, you can then add usernames that are familiar to your users, such as alain@[Link].

178. When updating domain information, you may be unable to complete the process and
encounter an HTTP 500 Internal Server Error message. Under some conditions, this error may be
expected. This message may appear if you try to use a protected DNS suffix. Protected DNS
suffixes may only be used by Microsoft.

179. You must include .com, .net, or any other top-level extension for this to work. When adding a
custom domain, the Password Policy values will be inherited from the initial domain.

180. Creating this TXT or MX record for your domain verifies ownership of your domain
name.

181. To configure [Link] for federated sign-on to your

Microsoft Entra ID, run Microsoft Entra Connect on your local network.

a. Download Microsoft Entra Connect

182. You can register as many domain names as you want. However, each domain gets its own
TXT or MX record. Be careful when you enter the information at the domain registrar. If you
enter the wrong or duplicate information by mistake, you'll have to wait until the TTL times
out (60 minutes) before you can try again.

183. When a subscription is associated with a different directory, users who have roles assigned
using Azure role-based access control lose their access. Classic subscription
administrators, including Service Administrator and Co-Administrators, also lose access.

184. Moving your Azure Kubernetes Service (AKS) cluster to a different subscription or moving the
cluster-owning subscription to a new tenant, causes the cluster to lose functionality due to
lost role assignments and service principal's rights.

185. you can use a couple of methods to authenticate yourself while moving files using AzCopy. The
first option is using azcopy login method which asks you to provide your Azure AD credentials
and the second method is to use Shared Access Signature (SAS) in the copy command
itself.

186. single Backup policy can be configured for only one kind of resource
187. You need to configure the alerts for VM1 and VM2 to meet the technical requirements.

a. the first step is to create a log analytics workspace where all the logs will be stored.
Next, we need to configure the performance counters we are interested in to bring in
from the connected resources. This step is important to make sure you do not import the
logs you do not need and thus save storage costs. Next, we will create a rule that
monitors the performance counters of VM1 and VM2 and triggers an alert if the free
space on volume C is less than 20 GB.

188. You need to add VM1 and VM2 to the backend pool of LB1.

a. Redeploy VM1 and VM2 to the same availability set is CORRECT because a basic load
balancer can connect to the VMs in a single Availability set or a Virtual machine
scale set. Hence you need to bring VM1 & VM2 inside an availability set.

189. in order to log the IP traffic from a VM, you can only use the storage account that is
deployed in the same region as the VM

190. Azure Active Directory (Azure AD) and shared access signatures (SAS) only is CORRECT as you
can use a couple of methods to authenticate yourself while moving files using AzCopy.
The first option is using azcopy login method which asks you to provide your Azure AD
credentials and the second method is to use Shared Access Signature (SAS) in the copy
command itself.

191. a standard Load balancer does not support VMs with basic Public IPs. Hence the first
action would be to delete the public IPs attached to these VMs.

192. the AzCopy tool is supported by all three kinds of Operating systems be it Windows,
Linux, or macOS.

193. VM1 does not have the custom DNS specified at the NIC level so it inherits the DNS settings
from the Vnet. VM2 does have the custom DNS specified at the NIC level so it does not inherit
the DNS settings from the Vnet.
a. If a custom DNS server is configured at the NIC level, the VM will use that DNS
server for resolving domain names.

b. If no DNS server is configured at the NIC level, the VM will inherit the DNS
server settings configured at the VNet level.

194. Az AKS install-cli is CORRECT as this command is required to install kubectl client on the
local computer. But this command requires AZ Cli pre-installed on the system to work

195. Advisor is based on Microsoft AI-based recommendation engine. It gives

recommendations based on different pillars like operational efficiency, performance, cost,
security, etc.

196. App service plan of tiers Standard, Premium, and Isolated only support staging slot. If the
option of a deployment slot is not available, then we need to scale up the App service
plan by changing the tier to Standard, Premium, or Isolated.

197. VMSS makes use of placement groups that act as implicit availability sets having the
default of 5 fault domains and 5 update domains. Hence during maintenance, each update
 domain will have 2 machines, and one domain will be updated at a time, hence leaving 8
machines up and running.

198. you can change the subnet a VM is connected to after it's created, but you cannot
change the VNet.

199. you cannot connect a VM with multiple VNet at the same time.

200. by default, all the Inbound access (DenlyAllInbound) is DENIED and therefore we
cannot connect to VM1 from the internet using the RDP.

201. By default, Azure routes traffic between all subnets within a virtual network, and
therefore from VM1 we can connect to VM2 using the RDP.

202. User3 has a User Administrator role and this role does NOT have permission to modify the
security questions which are set on the SSPR. (however, it can be done by a “Global
Admin” or “Authentication Administrator”)

203. Standard Load Balancer can only have Static IPv6 addresses of Standard SKU
attached to it. Basic Load Balancers on the other hand can connect only with Dynamic
IPv6 IPs and Basic SKUs.

204. all communications are allowed by default on all ports in the same virtual network
unless explicitly denied using NSG rules.

205. storage2 is CORRECT because it is a BlobStorage type located in the West US region, the same
region as the web app App1. Azure backup service uses block blobs to store backup data, so
BlobStorage type is suitable for this scenario. In addition, to minimize latency and costs
associated with outbound data transfer, it is generally recommended to place backup data
in the same region as the resource being backed up.

206. When adding a route to a routing table and specifying a next hop IP address, the
correct next hop type is Virtual appliance. A virtual appliance refers to a Network Virtual
Appliance (NVA), such as a firewall or load balancer, which inspects or processes network
traffic. By choosing Virtual appliance, you can specify the IP address of the NVA that will handle
the routed traffic.

207. NIC can only be created in the location in which we have our Virtual network.

208. there is no outbound rule specified for VM1 and no inbound rule for VM2 which is in
VNet1/Subnet2. Hence by default, since they are in the same VNet, communication is
allowed.

209. To ensure that you can push and pull signed container images in ContReg1, you need
to enable content trust. Content trust ensures that the integrity of the images is maintained
by verifying that the images are signed and have not been tampered with. This allows only
trusted and signed images to be pushed and pulled from the registry.

210. Auto registration for DNS records is supported only for private DNS zones when
linked to virtual networks

211. To ensure that the access keys for storage1 rotate automatically, you should store
the keys in Azure Key Vault and enable key rotation policies. Key Vault allows for the
 secure storage of secrets, including storage account access keys, and provides the ability to
configure automatic key rotation.

212. It is clearly evident from the documentation that you can manage encryption at the individual
blob or at the container level.

213. according to the Microsoft documentation, to enable multi-user authorization (MAU) for a
Recovery Services vault in Azure, you need to create a Resource Guard first. The
Resource Guard is a concept introduced by Azure for enhancing the security of critical
operations on Recovery Services vaults. It provides an additional layer of protection by requiring
multiple users to authorize critical operations.

214. Azure only allows to add co-administrators on the subscription scope.

215. setting up an Azure Monitor Private Link Scope is usually the initial step when
configuring private access to Azure Monitor. It defines the scope and configuration for
private communication between your resources and Azure Monitor.

216. Azure AD licenses can only be assigned to security groups and Microsoft 365
groups, but not to mail-enabled groups, because then you would not be able to manage the
membership dynamically.

217. Azure firewall can connect to a virtual network in the same region and also in the
same resource group. It cannot connect with the VNet in another resource group even if it is
in the same region.

218. Geo-replication in Azure Container Registry is only supported in the Premium SKU.
Since ContReg1 is currently using the Standard SKU, the first step to enable geo-replication is to
upgrade the SKU to Premium. Once the SKU is upgraded, you can configure geo-replication
across multiple regions.

219. when you enable the admin user for an Azure container registry, Azure provides the
registry name itself as the username.

220. Reader role gives you access to read the metadata and configuration of the storage
account (on the service-level). It does not give you read access to the content of blob
storage

221. Azure Container Instances support private networking only for Linux containers

222. virtual network peering allows you to connect two Azure virtual networks in the same or
different regions, enabling network traffic to flow through the Microsoft backbone network.

223. you can delete all users regardless of whether a license is assigned directly or inherited from
group membership. The licenses assigned to these users will be automatically removed when
the users are deleted.

224. Azure Bastion requires a subnet called AzureBastionSubnet with a minimum subnet
size of /26 or larger. This size is necessary to support host scaling and additional
features like file upload and download. the Standard SKU for the Public IP address is
required to support advanced features like host scaling and file upload/download capabilities
with Azure Bastion. Additionally, using a static allocation ensures that the IP address remains
 consistent, which is necessary for the reliable operation of Azure Bastion and maintaining
connectivity to the virtual machines in VNet1 and VNet2.

225. According to the identity-based access configuration shown in the exhibit, only users
synchronized from on-premises AD DS or those with hybrid identities can access the
file shares.

226. Peering is not supported between Azure Government and Public cloud
environments. Peering is only possible between virtual networks in the same cloud
environment.

227. the ZRS supports only general-purpose V2 storage accounts. Therefore “storage2” and
“storage3” support this condition. Now the second condition is that the storage account should
support “live migration”. It should be noted here that “live migration” is ONLY supported
for storage accounts that use ‘LRS’ and ‘GRS’ replication.

228. Web app “App1” is created in the original resource group “RG1”. Now, this needs to be moved
to resource group “RG4”. This does not have any web apps created in it and therefore
“App1” can be moved to “RG4”.

229. It should be noted here that the load balancer is a “Basic” load balancer and it should be
noted here that this supports Virtual machines in a single availability set.

230. in Azure, route tables (like RT1) can only be associated with subnets, not with virtual
networks (VNet1) or network interfaces (NIC1).

231. The "Logic App Contributor" role lets you manage logic apps, but you can't change
access to them. The developers should create Azure logic apps in the Dev resource
group and giving them the “Logic App Contributor” role would help them with this.

232. BLOB storage is the only storage that supports both the “Import” and “Export” in
an Azure Import/Export service.

a. Import support by block blobs, Page Blobs, Azure File Storage . Export supported by
only Block blobs, no azure files.

233. UNC path should you include in a script that references files from the data file share

a. [Link]\data
234. “General-purpose v1” and the “General-purpose v2” supports the “table” storage” and
“BlobStorage” does NOT support the “table” storage”.
a. The statement says that both General-purpose v1 and General-purpose v2 storage
accounts support Table Storage (used for structured, NoSQL data).
b. However, Blob Storage (used for unstructured data) does not support Table
Storage, which means you cannot use it to store data in a table format.
235. You need to synchronize the files in the file share named data to an on-premises server named
Server1.
a. Create a sync group.
b. Register Server1.
c. Install the Azure File Sync agent on Server1.