Microsoft Certified: Azure Administrator Associate Average Salary — $125,993
Candidates for the Azure Administrator Associate certification should have subject matter expertise implementing, managing, and monitoring an organization’s Microsoft Azure environment.
Responsibilities for this role include implementing, managing, and monitoring identity, governance, storage, compute, and virtual networks in a cloud environment, plus provision, size, monitor, and adjust resources, when needed.
AZ-104 Microsoft Azure Administrator Exam Breakdown:
Manage Azure identities and governance (15-20%),
Manage Azure AD objects,
Manage role-based access control (RBAC),
Manage subscriptions and governance,
Implement and manage storage (10-15%),
Manage storage accounts,
Manage data in Azure Storage,
Configure Azure files and Azure blob storage,
Deploy and manage Azure compute resources (25-30%),
Configure VMs for high availability and scalability,
Automate deployment and configuration of VMs,
Create and configure VMs,
Create and configure containers,
Create and configure Web Apps,
Configure and manage virtual networking (30-35%),
Implement and manage virtual networking,
Configure name resolution,
Secure access to virtual networks,
Configure load balancing,
Monitor and troubleshoot virtual networking,
Integrate an on-premises network with an Azure virtual network,
Monitor and back up Azure resources (10-15%),
Monitor resources by using Azure Monitor,
Implement backup and recovery,
Below are the top 50 Microsoft Azure Administrator Certification Questions and Answers Dumps.
Question 1: In our subscription, we have four different resource groups. They are RG1, RG2, RG3, RG4. RG2 has a Read-only lock at the resource group scope. RG3 has a Delete lock at the resource group scope. RG1 and RG4 do not have locks. We need to determine how we could move resources between resource groups during the lifecycle of these resources. Assuming all resources provisioned support moving between resource groups regardless of region. Which of the following statements are plausible?
A. We can move resources from RG1 to RG4.
B. We can move resources between any of these resource groups.
C. We can move resources from RG2 to RG4.
D. We can move resources from RG4 to RG3.
E. We can move resources from RG2 to RG3.
Azure Administrator Exam Prep App #Azure #AZ104 #AzureAdmnistrator #AzureDevOps #AzureAdmin #AzureTraining #AzureSysAdmin #AzureCloud #LearnAzure
Question 2: Your company has recently added a few new users to your Azure Active Directory. You have already added them to an active directory group, and now you have asked them to add their devices to the domain. When they add their devices, you have to ensure they are prompted to use a mobile phone to verify their identity. How do you configure this?
A. Require multi-factor authentication to join devices
B. Configure a point-to-site VPN
C. Enable Conditional Access
D. You must sign up for Azure AD Premium
Question 3: Under your Azure Subscription, you are trying to identify VMs that are underutilized in order to shutdown all VMs with CPU utilization under 5%. Which blade should you use?
A. Customer Insights
B. Advisor recommendations
Question4: You have just purchased the domain name arseemagroup.com from a third party registrar. Using your Azure Active Directory domain, you’d like to create new users with the suffix @arseemagroup.com. Which three things must you do?
A. Access the custom domain names blade from Azure AD
B. Create a MX or TXT record from arseemagroup.com DNS
C. Verify that you own the domain name
D. Access the App registrations blade from Azure AD
Question 5: You have two subscriptions named Subscription1 and Subscription2. You are logged into Azure using Azure PowerShell from Computer1. How can you identify which subscription you are currently viewing and then switch from one subscription to the other for the current session at Computer1.
A. Set-AzContext -SubscriptionName
Question 6: You have two subscriptions named Subscription1 and Subscription2. You are currently managing resources in Subscription1 from Computer1 that has the Azure CLI installed. You need to switch to Subscription2. Which command should you run?
A. az set account –subscription “Subscription2”
B. az account set –subscription “Subscription2”
C. az subscription set “Subscription2”
D. Select-AzureSubscription -SubscriptionName “Subscription2”
Question 7: You work at the IT help desk for Consilium Corporation. You have been getting an influx of calls into the help desk about resetting users’ passwords. They keep reporting that they can’t seem to figure out how to reset their password in order to gain access to their Customer Relationship Management (CRM) software. What do you do?
A. Ensure that the users who are having problems are within the correct AD group
B. Make sure you have Azure Active Directory Free
C. Make sure they have their verification device (mobile app or access to email)
D. Verify that self-service password reset is enabled in Azure Active Directory
Question 8: In this scenario, we are working for Cloud Chase Support. We our the active administrator, and we have been tasked with determining how to ensure we do not incur costs in either our Prod-Subscription and our Dev-Subscription for virtual machine resources. We have a CloudChase management group where both subscription nested. We decide to use Azure Policy to enforce compliance on Virtual Machines. Our Policy definition states that virtual machines are not an allowed resource type at the scope of our CloudChase management group. There are some existing virtual machines in our Prod-Subscription at the time this policy is created. After the enforcement of our new policy which of the below statements is true?
A. We cannot create virtual machines in any subscription under the scope of our management group and our existing virtual machines will be deallocated.
B. Virtual machines can be created in our Prod-Subscription if they are compliant.
C. Virtual machines can be created in our Dev-Subscription.
D. We cannot create virtual machines in any subscription under the scope of our management group.
Question 9: You recently signed up for Azure Active Directory Premium and need users to be able to reset their passwords if they are unable to login. What should you configure in Azure Active Directory?
A. Set “block sign-in” to off when creating the user
B. User password reset
C. User password change
D. Add user to sign-in group in Azure AD
Question 10: You have an Azure Pay-as-you-go Subscription named Subscription1. You have some concerns about cost for Subscription1, and you would like to spend less than $100.00 US per month on all resources in this subscription. If you spend more than $90.00 US, you would like to get an alert in the form of a text message. What should you do?
A. Shutdown VMs when you are not using them
B. Create an alert in Azure Monitor
C. Create a budget alert condition tied to an action group
D. Create a budget in the subscriptions blade
Question 11: We want to be provide an Azure AD B2B guest user the ability to manage all resources inside of our DevRG resource group. We want to give them these abilities over managing all resources inside of this resource group and nothing more. What role would we assign to the user to accomplish this goal? Assume we are assigning the role to the DevRG scope.
A. User Access Administrator
D. Global Admin
Question 12: You have just created a General-purpose V2 storage account in Azure. From a VM located in your on-prem environment, you’ve logged into your Azure subscription using the
Connect-AzConnect command from the PowerShell command line. Next, you need to retrieve the key, in order to access your storage account. Which PowerShell cmdlet will you use to retrieve the access key?
Question 13: You have been directed to copy all data from one storage account to another using the AzCopy tool. You need to report which storage services you can copy. Which of those services would it be?
A. Only Azure File Shares
B. Azure Queues and Blobs
C. Azure Blob and File Shares
D. Azure Table and File Shares
Question 14: You have a general purpose v1 storage account named
consiliumstore that has a private container named
container2. You need to allow read access to the data inside
container2, but only within a 14 day window. How do you accomplish this using the Azure Portal?
A. Upgrade the storage account to general purpose v2
B. Create a shared access signatures
C. Create a service SAS
D. Create a stored access policy
Question 15: You have an existing Microsoft Enterprise Agreement (EA) Subscription. You need to ship 34TB of data from an on-premise Windows 2016 server to your Azure storage account. You need to ensure that the data transfer has zero impact on the network, preserves your existing drives and is the fastest and most secure method. What should be your first step to starting the import job?
A. Open a ticket with Microsoft Support
B. Order an Azure Databox via the Azure Portal
C. Start an Import Job via the Azure Portal
D. Prepare your hard drives using the WAImportExport tool
Question 16: You have data in an AWS S3 Bucket named
myS3Bucket and you need to copy all of its contents to a container named
container1 in an Azure storage account named
companydata. Which command would be most efficient use of getting the data from the S3 bucket to the Azure storage container?
A. azcopy copy ‘https://s3.amazonaws.com/myS3Bucket’ ‘https://companydata.blob.core.windows.net/container1’ –recursive=true
B. aws s3 cp s3://mybucket/test.txt https://companydata.blob.core.windows.net/container1
C. azcopy blob copy ‘https://s3.amazonaws.com/myS3Bucket’ ‘https://companydata.blob.core.windows.net/container1’
D. azcopy copy sync ‘https://s3.amazonaws.com/myS3Bucket’ ‘https://companydata.blob.core.windows.net/container1’
Question 17: You have the following Azure Storage Accounts in your Subscription: stor1 (BlockBlobStorage) stor2 (FileStorage) stor3 (StorageV2) Which of these storage accounts can be converted to Read-Access Geo-Redundant Storage (RA-GRS) based on their storage account kind? Please select the most appropriate answer.
A. stor1 and stor2
D. stor1, stor2, and stor3
Question 18: You create an Azure storage account named
companystore with a publicly accessible container named
container1. You upload a file to
pic1.png. What will be the URL in order to access this blob?
Question 19: You have an Azure subscription named Subscription1. In Subscription1, you have an Azure virtual machine named VM1. Attached to VM1 are two network interface cards. You require a third network interface card with a network bandwidth above 1000 Mbps for your storage area network. What should you do?
A. Create an additional VM in the same subnet and connect to VM1 over the LAN
B. Create a new subnet with a sufficient number of available IP addresses
C. Create a new storage account to store data for VM1
D. Change the VM SKU to Standard_A4 or larger
Question 20: You are trying to create a new Azure Kubernetes Service (AKS) cluster from your local workstation. The AKS cluster must contain three nodes and ensure access to the worker nodes in order to troubleshoot the kubelet. You have authenticated to Azure from your local workstation with the Azure CLI. What command will you use to create an AKS cluster named AKS1 with the necessary components inside of the resource group named RG1?
A. az aks create -g RG1 -n AKS1 –generate-ssh-keys –node-count 3
B. az kubernetes create –name AKS1 –group RG1 –nodes 3 –generate-keys
C. az aks create –name AKS1 –resource-group RG1 –nodes 3 –ssh-key-value ~/.ssh/id_rsa.pub
D. az kubernetes create –name AKS1 –resource-group RG1 –nodes 3 –generate-keys
Question 21: VM1 is located in the West US region, and the OS disk is Premium SSD. The size of VM1 is currently Standard_D2s_v3, but you need to change the size to Standard_D2. You are able to select the size from the size blade, but you receive an error message. Why can’t you change the VM size?
A. You need to provide the username and password for the OS to upgrade
B. Standard_D2 does not support premium SSD disks
C. The size Standard_D2 is not available in the West US region
D. You did not shut down (deallocated) VM1 before you change the size
Question 22: You have an Azure Kubernetes Service (AKS) cluster named AKS1 within the resource group named RG1. You are trying run the command
kubectl get all from the Azure Cloud Shell (https://shell.azure.com) to view your cluster resources. You received the error
Error from server (BadRequest): the server rejected our request for an unknown reason. You’ve verified that the resources exist and the command is correct. What do you need to do in order to view your cluster resources from the Azure Cloud Shell?
A. Retrieve the access credentials using the command
az aks get-credentials --name AKS1 --resource-group RG1
B. Log into the cluster GUI from the Azure Portal
C. Install the kubectl tool
D. Access the Kubernetes Dashboard using the command
az aks browse --name AKS1 --resource-group RG1
Question 23: You have a subscription named Subscription1. You create a new Azure VM in your subscription named VM5 running Windows 2012 R2. You try to connect and login to VM5, but you get an error that says “We couldn’t connect to the remote PC. Make sure the PC is turned on and connected to the network, and that remote access is enabled.” You have verified that VM5 is running and has been assigned a public IP address. What change do you need to make in order to successfully connect and login to VM5?
A. Add a rule to the Network Security Group that will allow port 3389
B. Select Reset password from the VM blade
C. Use Network Watcher for detailed connection tracing
D. You need to access the VM from a computer that’s in the same subnet
Question 24: Subscription1 contains an Azure VM named VM1 with the following configuration:VM Size: Standard_D2s_v3
Public IP Address: 18.104.22.168
Resource Group: RG1
Availability Zone: None
Location: Japan East
Disk Type: Standard HDD
What are two things you can do to reduce data loss and achieve a 99.9% SLA?
A. Create a recovery services vault and enable replication for VM1
B. Move VM1 to a paired region
C. Place the VM in an availability zone
D. Change the disk type to Premium SSD
Question 25: You have created an application that is to be run on Linux containers named ContainerApp1. You’ve created an Azure container instance with an FQDN, but you notice that when the container restarts, all application data is lost. What is the best solution to preserve the data associated with your application?
A. Create a public blob storage container and share the URI with the application
B. Create a storage account and share the SAS with the application
C. Mount an Azure file share as a volume in Azure Container Instances
D. Run the container on a VM, and use the managed disk attached to the VM
Question 26: You’ve created a Dockerfile that contains the necessary steps to build an image that you plan to use for your application running as a Web App in App Services named APP1. You have created an Azure Container Registry, which is where you plan to store your images to be used for APP1. What should your next step be?
A. Run the
az acr build command
B. Create the App Service Plan
C. Run the
docker push command
D. Run the
docker login command
Question 27: You have an application that runs on instances in a Virtual Machine Scale Set. The number of instances in the VMSS is at three starting Monday. The minimum number of instances is one, and the maximum is 5 instances. There are two scaling rules for this VMSS:
|Rule1||CPU > 75%||+1 instance|
|Rule2||CPU < 25%||-1 instance|
Based on the rules above and the chart below, on Wednesday how many instances will there be in our VMSS?
|CPU%|Time(UTC)|Day |:—|:—:|:—:|—:| |75|12:01|Tuesday| |20|13:36|Tuesday| |85|12:10|Wednesday| |20|19:07|Thursday|
A. 2 instances
B. 3 instances
C. 4 instances
D. 5 instances
Question 28: Subscription1 contains an Azure VM named VM1. You have added a data disk to VM1, as well as a new network interface card. You need to create two more Azure VMs just like this one named VM2 and VM3. What is the most efficient way to create VM2 and VM3 that will minimize cost?
A. Backup the VM and recover to a different region
B. Redeploy VM1 with the new disk and NIC and deploy the template to VM2 and VM3
C. Select Export template from VM1 blade, then deploy VM2 and VM3 with that template
D. Create an image from VM1 and use the image to deploy VM2 and VM3
Question 29: You have an Azure subscription named Subscription1. You have created a web app named App1 in Subscription1 that is sourced from a git repository named Git1. You need to ensure that every commit to the master branch in Git1 triggers a deployment to a test version of the application before releasing it to production. What are two changes that you must make to App1 to fulfill this requirement?
A. Create a build server with the master branch of Git1 as the trigger
B. Configure custom domains for test and production versions of App1
C. Add a new deployment slot to App1 to release the test version of App1
D. Create a new web app and configure failover settings from test to production
Question 30: You plan to create an Azure Web App in the East US region. You need to ensure that this web app scales out with demand, to prevent downtime. You also need to ensure that the data that resides inside of the application will remain secure and never become exposed to anyone outside of the organization. Which App Service plan SKU will you chose that will meet these requirements and also save on cost?
Question 31: VM1 is located in the East US region. You have added a premium SSD data disk to VM1, but the IOPS are not satisfying the needs of your application, how can you change the speed of the disk?
A. Select the disk configuration and increase the size
B. Shut down (Deallocate) the VM
C. Export the disk and convert to VHD
D. Create a new disk and migrate the data
Question 32: The NoName Company has just deployed a number of Azure VMs into a specific subnet in an Azure virtual network. They have also implemented a network security plan which includes the use of Azure Firewall. From those newly deployed VMs, the company wants to deny access to the website https://www.microsoft.com. How can you achieve this using their current Azure resources?
A. A network rule
B. Create a route via Route Table to the firewall (as a virtual appliance hop)
C. Configure an application rule on the Azure Firewall that blocks FQDNS www.microsoft.com
D. An Application Gateway
E. A Subnet named
F. A VPN Gateway
Question 33: You need to create an Azure virtual machine named VM1 that requires a static private IP address configured inside the IP address space for the VNet in which the VM resides. How do you configure a static IP address for this Azure VM?
A. After the VM has been created, create a new network interface and configure a static IP address for that network interface
B. After the VM has been created, go to the network interface attached to the VM and change the IP configuration to static assignment
C. When creating a VM in the portal, select
New next to private ip address and choose static after assigning the correct IP address
D. When creating the VM in the portal, change the setting from dynamic to static on the networking tab under private IP address
Question 34: You have an Azure subscription named Subscription1. In Subscription1, you have a web server that has the IP address 10.1.0.83 and a database server that has the IP address 10.1.0.142. Instead of remembering the IP addresses of the servers, you’d like to connect to these servers using a DNS name. With no DNS server currently, and without having to create a new DNS server, how can you access your database server from your web server by the DNS name db.yourcompany.com?
A. Public DNS Zone
B. Promote Server to Domain Controller
C. Access the Domain Controller
D. Private DNS Zone
Question 35: You have an Azure subscription named Subscription1. In Subscription1 you have two VNets, one named VNet-Hub and one named VNet-Spoke. Within VNet-Hub, there is an Azure Firewall with a public IP address, configured as a Standard SKU. In VNet-Spoke, there is a Windows Server 2016 with no public IP address and no Network Security Group (NSG). Using which three items can you utilize the public IP address of the Azure firewall to connect to the Windows Server, without exposing the server to the public internet directly?
A. NAT Rule for the Firewall
B. Route Table
C. Virtual Network Gateway
D. Virtual Network Peering
E. ExpressRoute Gateway
Question 36: You have an on-premises environment as well as your Azure environment with a subscription named Subscription1. Subscription1 has a virtual network named VNET1 and you need to connect to the on-premises network securely using an ExpressRoute link and Site-to-site VPN. What Azure resources do you need in order to establish the connection while minimizing cost?
A. Azure VPN Gateway
B. Network virtual appliance
C. No resources needed, ExpressRoute is encrypted by default
D. A route table
Question 37: You have a Network Security Group (NSG) that is associated with a network interface that is attached to an Azure virtual machine named VM1 running Windows Server 2019. VM1 is in subnet named subnet1, in a virtual network named VNet1. A different NSG is attached to subnet1, but you notice that there is an inbound rule to allow port 3389. When you try to connect to VM1, you cannot connect. You reviewed the NSG and the source IP address and the protocol are correct. How can you connect to VM1 using best practices for NSGs in Azure?
A. The protocol on the NSG rule is set to UDP
B. The NSG attached to the network interface needs to be removed
C. The source IP address on the NSG rule is incorrect
D. You need to add an inbound rule for the NSG attached to the network interface
Question 38: You have an Azure subscription named Subscription1. In Subscription1 you have an Azure VM named VM1 with Windows Server 2019 as the operating system. VM1 does not have a public IP address assigned to it. VM1 is located in a virtual network named VNet1, in subnet1. Attached to subnet1 is a Network Security Group (NSG) that has port 3389 open inbound. On your local machine, you do not have an RDP client installed, but you need to login into the VM. Without assigning a public IP address to the VM, what three things in combination can we use to log into VM1?
A. HTML5 supported Web Browser
B. Azure VPN Gateway
C. A subnet named
D. A Gateway Subnet
E. Azure Bastion Host
F. Inbound security rule to open port 443
Question 40: You have a subscription named Subscription1. Subscription1 has one Azure virtual machine named VM1 which is an Ubuntu server. You can’t seem to login to the server via SSH. What tool should you use to verify if the problem is the network security group?
A. IP flow verify tool in Azure Network Watcher
B. Azure Monitor VM metrics
C. Azure Traffic Manager traffic view
D. Azure Virtual Network logs
Question 41: You have two Azure virtual machines named VM1 and VM2. VM1 is using the Red Hat Enterprise Linux 8.1 (LVM) operating system and is located in VNet1, within subnet1. VM2 is using the Windows Server 2019 operating system, and is located in VNet1, within subnet2. VNet1 has custom DNS configured, pointing to a DNS server with the IP address 22.214.171.124. VM2 has 10.0.1.15 configured as the DNS server on its network interface. Which DNS server will VM2 use for DNS queries?
B. 10.0.1.15 for primary, 126.96.36.199 as secondary
Question 42: You have created a new Azure virtual machine in a subnet named Subnet1 with an attached network interface card named NIC1. The NIC1, attached to Subnet1, has the following effective routes:
|Source||State||Address Prefix||Next Hop|
What will happen when the virtual machine tried to communicate with a VM on a different network?
A. Traffic will be sent successfully
B. Traffic will be forced out to the internet
C. Traffic will be forced internally
D. Traffic will be dropped and no connection will be established
Question 43: You have a standard load balancer that directs traffic from port 80 externally to three different virtual machines. You need to direct all incoming TCP traffic on port 5000 to port 22 internally for connecting to Linux VMs. What do you need in order to connect to the VM via SSH?
A. A public IP address for all three VMs
B. A Route Table with at least one rule
C. A Network Security Group (NSG)
D. A Network Address Translation (NAT) Rule
Question 44: You have a web application that serves video and images to those visiting the site. You start to notice that your web server is overloaded, and often crashes because the requests have consumed all of its resources. To combat this, you’ve added an additional web server and you plan to load balance these servers by serving images from the first server only and serving video from the second server only. Which Azure resource can you implement that will properly load balance (at OSI layer 7) with URL-based routing and secure with SSL at the lowest cost?
A. Azure Load Balancer
B. Azure Front Door
C. Azure Application Gateway
D. Web Application Firewall
Question 45: You manage a virtual network named VNet1 that is hosted in the West US region. Two virtual machines named VM1 and VM2, both running Windows Server, are on VNet1. You need to monitor traffic between VM1 and VM2 for a period of five hours. As a solution, you propose to create a connection monitor in Azure Network Watcher. Does this solution meet the goal?
Question 46: You have an Azure subscription named Subscription1. You would like to connect your on-premises environment to Subscription1. You have to meet three requirements from the business. The first requirement is that the connection from the on-premises office and Azure must be a private connection. No network traffic is allowed to go over the public internet. The second requirement is that all traffic from the on-premises office and Azure must happen at layer 3 (network layer). The third requirement is that this connection from on-premises to Azure must be redundant to minimize the opportunity for failure. What type of connection fulfills these three requirements?
A. ExpressRoute with premium add-on
C. Site-to-Site VPN
D. Virtual WAN
Question 47: You have an Azure subscription as well as an on-premises environment that is connected via ExpressRoute circuit. You have two additional branch offices that you need to connect to the network, as well as ten remote employees that change locations frequently but still need access to Azure resources. What is the solution that will provide the quickest setup at the lowest cost?
A. Site-to-Site VPN
B. Point-to-Site VPN
C. Virtual WAN
D. Hub-and-Spoke Network Topology
Question 48: You have a small number of servers running a microservice, and you want to make sure that all the servers have connectivity to each other. You also need to calculate network performance metrics like packet loss and link latency. Which two Azure resources do you need to meet this requirement?
A. Log Analytics Workspace
B. Network Performance Monitor
C. Azure Monitor
D. Azure Traffic Manager
Question 49: You have two virtual networks named VNet1 and VNet2. VNet1 is located in the West US region, whereas VNet2 is located in the East US region. You need to configure a virtual machine that’s located in VNet1 to also communicate with VMs in VNet2. From the choices available how can we enable communication between resources in VNet1 and VNet2
A. Migrate the VNet1 VM to VNet2 and leave the other VM components on VNet1
B. Migrate the network interface card (NIC), the network security group (NSG) and the VM disks to VNet2
C. Just the VM disks will need to be migrated to VNet2
D. Configure a VNet-to-VNet VPN gateway connection to allow communication between VNets in different regions
Question 50: You have two subscriptions, one named Subscription1 and the other named Subscription2. Both subscriptions are located within the same tenant. You have one Azure virtual machine located within Subscription1 and another Azure virtual machine within Subscription2 and you’d like to view CPU utilization metrics on both virtual machines. How can you achieve this while maintaining the minimum number of Azure resources and minimizing cost?
A. Create a Log Analytics Workspace for both VMs
B.Turn on VM Insights in Azure Monitor
C. Install the Log Analytics (OMS) Agent on the VMs
D. Enable guest-level monitoring on each VM
Question 51: You have created a new Azure virtual machine named VM1. You plan to use VM1 as a web server, which will require the VM to be accessible using HTTP/S (HTTP and HTTPS) protocol. A Network Security Group (NSG) is attached to the NIC of VM1 with the following rules:
Priority|Name|Port|Protocol|SRC|DEST|Action| |:—|:—:|:—:|:—:|:—:|:—:|—:| |300|Rule2|80|TCP|Any|Any|Deny| |400|Rule1|443|TCP|Any|Any|Deny| |500|Rule4|60-500|TCP|Any|Any|Allow| |600|Rule5|22|TCP|188.8.131.52/32|Any|Deny| |1000|Rule3|22|TCP|Any|Any|Allow|
What changes do you have to make to the NSG in order to meet the requirements for VM1?
A. Change the priority of Rule3 to 200
B. Change the action of Rule1 to Allow
C. Change the priority of Rule4 to 200
D. Change the port of Rule5 to 443
Question 52: You have an Azure virtual machine running Windows Server 2016. You need to collect OS level metrics on this virtual machine, including Windows event logs and performance counters. Which of the following items do you need in order to collect this metrics data?
A. Enable guest-level monitoring
B. Windows Diagnostics Extension
C. Log Analytics Agent
D. InfluxData Telegraf Agent
E. Storage Account for Diagnostic Data
Question 53: You have an Azure subscription with a virtual machine named VM1. You are using Recovery Services Vault (RSV) to backup VM1 with soft delete enabled. The backup policy is set to backup daily at 11 PM UTC, retain an instant recovery snapshot for 2 days, and retain the daily backup point for 14 days. After the initial backup of VM1, you are instructed to delete the vault and all of the backup data. What should you do?
A. Turn off soft delete in the vault security settings
B. Wait 14 days
C. Stop the backup of VM1 and delete backup data
D. Delete the backup policy
E. Delete Backup Jobs Workload
F. Wait 15 days
Question 54: You have a number of virtual machines and web applications running in your Azure environment. These Azure resources are critical for business operations, so you’ve locked the resources in order to prevent deletion. In addition, how can you alert on these actions in the portal, and notify your team via email and SMS when a user is trying to delete or create a new resource from within your Azure subscription?
A. Pin the activity log to your dashboard
B. Create a new alert rule
C. Query Administrative Events and Copy Link to Query
D. Create a new action group
Question 55: You have a .NET Core application running in Azure App Services. You are expecting a huge influx of traffic to your application in the coming days. When your application experiences this spike in traffic, you want to detect any anomalies such as request errors or failed queries immediately. What service can you use to assure that you know about these types of errors related to your .NET application immediately?
A. Client-side monitoring
B. Live Metrics Stream in Application Insights
C. Application Insights Search
D. Log analytics workspace
Question 56: You have an Azure subscription named Subscription1. In Subscription1 you have two Azure VMs named VM1 and VM2, both running Windows Server 2016. VM1 is backed up using Recovery Services Vault, with a backup policy of producing a daily backup and keeping that daily backup for seven days. Also, a snapshot is kept for 2 days. VM1 is compromised by a virus that infects the entire system, including the files. You need to restore the files from yesterday’s backup of VM1. Where can you restore the files to in the quickest manner?
A. A new Azure VM
B. Restore the VM1 snapshot
Question 57: You have a subscription named Subscription1. You would like to be alerted upon certain administrative events within Subscription1 to detect unauthorized access. Which of the following is the quickest method to setup these types of alerts?
A. Monitor > Alerts > New Alert Rule
B. Log Analytics Workspace > myWorkdspace > Advanced Settings
C. Policy > Assignments > Assign Policy
D. Subscriptions > mySubscription > Activity Log > New Alert
Microsoft Azure Administrator Certification Q&A:
What does az vmss deallocate do?
az vmss deallocate command will deallocate and remove the VMs within a VMSS. Azure Doc
A company is planning to use Azure for the various services they offer. They want to ensure that they can bill each department for the resources they consume. They decide to use Azure resource tags to separate the bills department wise. Would this fulfill the requirement?
– Yes, you can use resource tags to organize your Azure resources and also apply billing techniques department wise. The Microsoft documentation mentions the following.
– Reference: Azure resource tags
A company is planning to use Azure for the various services they offer. They want to ensure that they can bill each department for the resources they consume. They decide to use Azure rolebased access control to separate the bills department wise. Would this fulfill the requirement?
– No, This is used to control access to resources and can’t be used for billing purposes.
– Reference: Azure Role Based Access Control
A company is planning to use Azure for the various services they offer. They want to ensure that they can bill each department for the resources they consume. They decide to use Azure policies to separate the bills department wise. Would this fulfill the requirement?
– No, Azure policies are used from a governance perspective and can’t be used to create bills department wise.
– Reference: Azure Gov policies
A company is planning to use the Azure Import/Export service to move data out of its Azure Storage account. Which of the following service could be used when defining the Azure Export job?
– Only the BLOB service is supported by the Export job feature. This is also given in the Microsoft documentation.
– Reference: Azure Blob Storage
Suppose you have an application running on a windows virtual machine in azure. what is the best-practice guidance on where the app should store data files?
– Dedicated data disks are generally considered the best place to store application data files. They can be larger than OS disks and you can optimize them for the cost and performance characteristics appropriate for your data.
Azure Breaking News – Azure Certifications Testimonials
- How can I add new secrets to Azure keyvault which has private endpoint enabledby /u/curious_17 (Microsoft Azure) on May 26, 2022 at 9:14 pm
I have a keyvault which has private endpoint enabled. I have allowed our WAN IP on the keyvault firewall but when I browse to the "Secrets" tab then I get the following error:- " The connection to data plane failed. Please refresh and try again. If Private Links are enabled on the vault and the issue persists please follow the steps in the following link https://go.microsoft.com/fwlink/?linkid=2156688 . " Also, I have VMs on the same subnet as the keyvault endpoint address. But the internet access is only allowed through proxy on those VMs. The subnets for these VMs are allowed on the keyvault firewall. If try to access the keyvault from Azure console from these VMs through proxy I get following error:- "Refresh the browser to try again. Microsoft\Azure_KeyVault extension failed to load.) Please visit Portal Self Help to perform diagnostics." There is a DNS problem I have noticed with our Azure hosted DNS zone. "keyvaultname.vaultcore.azure.net" does not alias to "keyvaultname.privatelink.vaultcore.azure.net" on these Azure VMs or on on-prem network. So for now I added a host file entry to resolve "keyvaultname.vaultcore.azure.net" to the private endpoint IP address. But still the keyvault console access gives the above error on these Azure VMs. How can I access existing secrets and add new ones to this vault using console (or powershell from the Azure VMs will be the only option to access these)? submitted by /u/curious_17 [link] [comments]
- The best way to domain join an Azure VM?by /u/StealthCatUK (Microsoft Azure) on May 26, 2022 at 8:33 pm
We have just started a POC with Azure ARM. We have an express route connection to our on-prem network/AD domain. I have been exploring Azure Bicep and Terraform, successfully deploying some basic resources such as vnet subnet and a few VMs. One of the problems I need to solve, is that during the deployment, windows VMs must join the on-prem domain. What is the best way to achieve this with bicep or terraform, or any other methods that could be automated? We are also on the process of getting to know Azure DevOps, so the solutions must be hands off. Cheers submitted by /u/StealthCatUK [link] [comments]
- Azure Runbook - Hybrid Worker as elevated userby /u/adamncl (Microsoft Azure) on May 26, 2022 at 7:54 pm
I am trying to run my runbook on a hybrid worker as elevated user - the exe that it runs requires administrative permissions - has anyone managed to achieve this? submitted by /u/adamncl [link] [comments]
- How to automatically have users sign into Edge on hybrid-joined PC?by /u/Real_Lemon8789 (Microsoft Azure) on May 26, 2022 at 6:58 pm
I created a gpo with this setting: "Force synchronization of browser data and do not show the sync consent prompt" The group policy is applied, but the user is not getting signed into Edge automatically. User has E3 and P2. Are there any other requirements to get this working? submitted by /u/Real_Lemon8789 [link] [comments]
- [Azure ACR] How can I delete untagged manifests?by /u/Thecakeisalie25 (Microsoft Azure) on May 26, 2022 at 6:48 pm
I've been brought on board a new project, and I'm looking at the ACR for it (it uses IoT edge) and it's taking up ~40GB. Before I got here, the dockerfile was arranged poorly, such that copying over the code was the first step, and so all other steps (apt update, install deps, etc) were never cached. That probably explains why it was so bloated, but why does it take up that much space NOW? I've deleted all the images from old (way old) versions of our modules, but the storage space doesn't go down. Even after I've deleted every single tagged image, it still takes up ~40GB, there's a bunch of manifests floating around in there that aren't tagged, and I want them to stop being there. Is there a way to do this? I've fixed the dockerfile so that new builds are only 7kb, so I only really need to purge it this once. submitted by /u/Thecakeisalie25 [link] [comments]
- Logic App - Get File Content File Size Limitby /u/phxkent (Microsoft Azure) on May 26, 2022 at 6:24 pm
After a year of working perfectly, I have a logic app that started to show inconsistencies. The app checks an FTP site for new files, gets the file metadata, gets the file content of the new file, saves the file content as a new blob, and sends an email when it has run. The problem appears to occur in the the "Get File Content" step. Prior to 5/1, the the process would process files greater than 10MB. As of 5/1/22, the Get file Content only copies 10 MB. Therefor the new blobs being created do not include all of the file content when the file is greater than 10MB. The process doesn't fail, it just doesn't copy all the contents. The file metadata step clearly shows that the file is greater than 10MB. Has anyone else experienced this? Is this a new change as of 5/1? Any way to fix this? submitted by /u/phxkent [link] [comments]
- Availability Setby /u/Sketchy011 (Microsoft Azure) on May 26, 2022 at 5:59 pm
Noob question, have Availability Sets always just protected against data center failure and nothing more? If so, is there anything where I can replicate to zones to cover that issue? submitted by /u/Sketchy011 [link] [comments]
- PIM Global Administrator group - Users at risk detected alerts Not Workingby /u/Cloud_Comp_Admin (Microsoft Azure) on May 26, 2022 at 4:19 pm
We're testing out PIM and are having issues with notifications. In Azure, the Risky notifications aren't going to a PIM group created to assign the Global Administrator role. We have two users in this group, and two people with the access directly assigned and aren't in PIM. The two people with the access directly assigned are getting the notifications. I confirmed in the Users at risk detected alerts have the two people with the Global administrator role directly assigned to them, but not hose with the PIM group. According to the page in Security -> Identity Protection -> Users at risk detected alerts: " If a user is enrolled in PIM to elevate to one of these roles on demand then they will only receive emails if they are elevated at the time the email is sent. The Admin's configured email must be able to pass the validation checks for custom emails on the "Users at risk detected alerts" page." I'm not sure what "The Admin's configured email must be able to pass the validation checks for custom emails on the "Users at risk detected alerts" page." means since when the two users with the PIM Global Administrator group currently assigned to them were getting emails when they had the Global Administrator role directly assigned to them . Checked the page: Azure Active Directory Identity Protection notifications | Microsoft Docs which didn't help. Any guidance is much appreciated, thanks in advance for the advice! submitted by /u/Cloud_Comp_Admin [link] [comments]
- Azure AD for mobileby /u/LeonardoDaWitchy (Microsoft Azure) on May 26, 2022 at 3:58 pm
Hello all and thank you for looking at my post. I am developing a mobile app (cross platform) which requires users to authenticate. My organization would like to use Azure AD (we have enterprise license). Here’s my issue. It doesn’t appear that with Azure AD I can create my own custom login screen inside the app. I understand I can create custom login views from the azure portal or even upload my own html files etc. That’s all good but what I am trying to do is have a screen inside the app with two fields (username and password) and when the user taps on the sign in button they log in upon successful authentication. All I could find right now was in my app registration to use a callback url so essentially the user will exit the app, be taken to a browser window to login to AAD and then be redirected back to the app. I really would prefer to avoid such a scenario. Am I going about this the wrong way? Thanks in advance - Leo submitted by /u/LeonardoDaWitchy [link] [comments]
- Azure - Provisioning failedby /u/farchris (Microsoft Azure) on May 26, 2022 at 3:50 pm
Hello, I want to increase the tcp idle timeout but it's not possible because the vm is faulty (see attached image below). I tried the "Redeploy + reapply" option but it doesn't help. On a windows-system you can run "sysprep" via rdp but in this case it's a linux machine (CentOS) only with ssh-access. Does anyone know how can I remove the error? Thank you for your help! https://preview.redd.it/tnlixamicu191.png?width=1662&format=png&auto=webp&s=7f872aceb2c9a122acaa0c9ed5fec4d2f037d2e8 submitted by /u/farchris [link] [comments]
- Access a dashboard similar to how you use a sas tokenby /u/famelton (Microsoft Azure) on May 26, 2022 at 3:50 pm
We have an Azure dashboard that we would like to add to a wall TV for monitoring but I was wondering if you could get "secure/authenticated" access in the same way a sas token works against a storage account to give read only live access? submitted by /u/famelton [link] [comments]
- Azure Firewall integration with Internal Load Balancerby /u/0x4ddd (Microsoft Azure) on May 26, 2022 at 2:32 pm
Another question about Azure Firewall 😉 I thought I understand how Azure Firewall integration with Public/Internal Load Balancer works but I think I miss something. Docs (https://docs.microsoft.com/en-us/azure/firewall/integrate-lb#asymmetric-routing) show some diagrams how the traffic flows when there is a Public Load Balancer and Azure Firewall and how to integrate these two together. Asymmetric routing is where a packet takes one path to the destination and takes another path when returning to the source. This issue occurs when a subnet has a default route going to the firewall's private IP address and you're using a public load balancer. In this case, the incoming load balancer traffic is received via its public IP address, but the return path goes through the firewall's private IP address. Since the firewall is stateful, it drops the returning packet because the firewall isn't aware of such an established session. Diagram: https://docs.microsoft.com/en-us/azure/firewall/media/integrate-lb/firewall-lb-asymmetric.png I think I understand this part and the necessity for DNAT rule. My understanding (numbers are flows shown on the diagram). Client makes a request to Azure Firewall Source IP: Client IP Destination IP: FW PiP Firewall DNATs and SNATs to Public Load Balancer Source IP: FW PiP Destination IP: LB PiP Public Load Balancer routes traffic to VM Private IP Source IP: FW PiP (as I understand, Azure Load Balancer always preserves Source IP) Destination IP: VM Private IP VM responds Source IP: VM Private IP Destination IP: FW PiP UDR routes flow to the Internet via FW PiP instead of routing it to FW Private IP Source IP: FW PiP Destination IP: Client IP So far so good. However, next docs describe how to integrate Azure Firewall with Internal Load Balancer: With an internal load balancer, the load balancer is deployed with a private frontend IP address. There's no asymmetric routing issue with this scenario. The incoming packets arrive at the firewall's public IP address, get translated to the load balancer's private IP address, and then returns to the firewall's private IP address using the same return path. And here I do not really understand why there's no asymmetrc routing with this scenario. What's the difference? Isn't it like I need a DNAT rule anyway in the step 2 to translate to Internal LB IP and then wherever I had LB PiP in the previous scenario now I will have Internal LB IP? If so, I do not understand why there is no asymmetric routing as incoming traffic enters Firewall using Public IP and then it's routed to Firewall Private IP. submitted by /u/0x4ddd [link] [comments]
- Azure Zip deployment via AZ CLI very slow.by /u/spGT (Microsoft Azure) on May 26, 2022 at 2:00 pm
Recently my az function app deploy has stated taking 26 min. WARNING: Getting scm site credentials for zip deployment 21:31:16 WARNING: Starting zip deployment. This operation can take a while to complete ... 21:56:16 WARNING: Deployment endpoint responded with status code 202 21:56:24 INFO: Fetching changes. 21:56:28 INFO: Fetching changes. 21:56:38 INFO: Triggering recycle (preview mode disabled). 21:56:42 INFO: Command ran in 1550.888 seconds (init: 0.177, invoke: 1550.711) How can I debug the cause? I already have it set to verbose but it doesn't show much... submitted by /u/spGT [link] [comments]
- Best way to test connectivity from Azure WebApp to Azure SQLby /u/apdunshiz (Microsoft Azure) on May 26, 2022 at 1:14 pm
HI guys, I have a webapp that needs to connect to Azure SQL. I know that a private endpoint method works, but this can be costly since it costs $0.01/GB/Month, just for the data processed. I can telnet/tcpping the webapp from the console, or even the browser debug option, but this is not a valid test. From my understanding, you can telnet or TCP ping on 1433 to ANY Azure SQL connection URL, if public access is allowed, but then it will sift through the whitelisted public IPs after that. Meaning, you will always get a response unless you specifically deny public access. I have added my webapp to an outbound integration subnet, added the SQL Service Endpoint to that subnet, and cannot see any errors in the logs but am not sure if I am 100% connected. I am not familiar with the actual webapp or what database does what (that is on someone else)... my job is to just make sure connectivity is there. Thanks in advanced! submitted by /u/apdunshiz [link] [comments]
- Why Does Guest Login Requires Printer Setup Each Timeby /u/BBQingFool (Microsoft Azure) on May 26, 2022 at 12:48 pm
We have a guest login with no password setup on about 100 computers that auto deletes and resets things when that account logs off. However, it also resets the printer that is needed by our clients, so each new login requires the user to double click the printer and install it. Is there a way to have that printer installed permanently to avoid this? Appreciate any thoughts/advice. submitted by /u/BBQingFool [link] [comments]
- Azure Firewall integration with Gateway Load Balancerby /u/0x4ddd (Microsoft Azure) on May 26, 2022 at 12:15 pm
I've been reading about Gateway Load Balancer helping dealing with asymmetric routing problems when using firewalls/other NVAs. It looks great, however I'm curious if Gateway Load Balancer can work with Azure Firewall out-of-the box? Typically, the issue with Azure Firewall used only as an outbound firewall was that the Firewall was unaware of incoming packets and then it dropped outgoing packets. The resolution was to create public IPs on the Azure Firewall level and then route all incoming traffic through Azure Firewall. Then it had to DNAT to standard Load Balancer and application workload had an UDR routing all outbound traffic through firewall private IP address - https://docs.microsoft.com/en-us/azure/firewall/integrate-lb#fix-the-routing-issue Now, for several available NVAs it looks like this is possible to achieve with just a Gateway Load Balancer and chaining so we do not have to configure any DNAT or public IPs assigned to Gateway Load Balancer/NVAs. So the question is - does Azure Firewall work with Gateway Load Balancer? 😉 submitted by /u/0x4ddd [link] [comments]
- Autopilot helpby /u/IronBalanski (Microsoft Azure) on May 26, 2022 at 11:49 am
We are attempting to simplify the OOBE process for users and I'm wondering if it is possible to pull dish the user related policies/applications during the autopilot stage. I've attempted to do this by assigning a user to the machine prior to the autopilot but it doesn't work. Any ideas? For context we are in a hybrid environment and want users to have their own primary device. submitted by /u/IronBalanski [link] [comments]
- Can I pull data from Oracle database hosted on Linux through ADF?by /u/dipanshusheoran (Microsoft Azure) on May 26, 2022 at 11:10 am
If yes then what are the steps for it ? Do I need to install anything on the host environment? submitted by /u/dipanshusheoran [link] [comments]
- [Certification Thursday] Recently Certified? Post in here so we can congratulate you!by /u/AutoModerator (Microsoft Azure) on May 26, 2022 at 11:00 am
This is the only thread where you should post news about becoming certified. For everyone else, join us in celebrating the recent certifications!!! submitted by /u/AutoModerator [link] [comments]
- No logs in Loganalytics after targeting a specific Log Analytics workspace Resource Idby /u/Primary-Pace5228 (Microsoft Azure) on May 26, 2022 at 10:04 am
I ran below command with success : az aks enable-addons -a monitoring -n <AKS Cluster> -g <resource group of AKS Cluster> --workspace-resource-id <resource-id-for loganalytics workspace> Then I also confirmed if omsagent is running: https://preview.redd.it/v8x14cez7s191.png?width=1363&format=png&auto=webp&s=d5a4db05bc4c55ad578bf68e6b915a2a24c0d040 But while I am checking in the Loganalytics , I can not find the logs for my cluster: https://preview.redd.it/2s9ejvqmks191.png?width=840&format=png&auto=webp&s=e920cd4d8cad451ff70802637223061c2dbf1be4 https://preview.redd.it/rn1ikalans191.png?width=1426&format=png&auto=webp&s=2adbe4a4753f4f9a13a1af889a46cfee2492c5cd How can I see the pods or container logs. Do I need to enable containers to push the logs in Loganalytics or is there some easy way out. submitted by /u/Primary-Pace5228 [link] [comments]
A Twitter List by enoumen