Note: This question is part of series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have an Azure Active Directory (Azure AD) tenant named contoso.com.

A user named Admin1 attempts to create an access review from the Azure Active Directory admin center and discovers that the Access reviews settings are unavailable. Admin1 discovers that all the other Identity Governance settings are available.

Admin1 is assigned the User administrator, Compliance administrator, and Security administrator roles.

You need to ensure that the Admin1 can create access reviews in contoso.com.

Solution: You assign the Global administrator role to Admin1.

Does this meet the goal?

Reveal Solution Hide Solution

Note: This question is part of series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have an Azure Active Directory (Azure AD) tenant named contoso.com. A user named Admin1 attempts to create an access review from the Azure Active Directory admin center

and discovers that the Access reviews settings are unavailable. Admin1 discovers that all the other Identity Governance settings are available. Admin1 is assigned the User administrator, Compliance administrator, and Security administrator roles. You need to ensure that the Admin1 can create access reviews in contoso.com.

Solution: You purchase an Azure Directory Premium P2 license for contoso.com.

Does this meet the goal?

Reveal Solution Hide Solution

You have a resource group named RG1 that contains the following:

– A virtual network that contains two subnets named Subnet1 and Subnet2

– An Azure Storage account named contososa1

– An Azure firewall deployed to Subnet2

You need to ensure that contososa1 is accessible from Subnet1 over the Azure backbone network.

What should you do?

Deploy an Azure firewall to Subnet1.

Remove the Azure firewall.

Implement a virtual network service endpoint.

Create a stored access policy for contososa1.

Reveal Solution Hide Solution

Your company has the groups shown in the following table.

The company has an Azure subscription that contains an Azure Active Directory (Azure AD) tenant named contoso.com.

An administrator named Admin1 attempts to enable Enterprise State Roaming for all the users in the Managers group.

Admin1 reports that the options for Enterprise State Roaming are unavailable from Azure AD.

You verify that Admin1 is assigned the Global administrator role.

You need to ensure that Admin1 can enable Enterprise State Roaming.

What should you do?

Reveal Solution Hide Solution

HOTSPOT

You play to deploy an Azure virtual machine named VM1 by using an Azure Resource Manager template. You need to complete the template.

What should you include in the template? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Reveal Solution Hide Solution

Correct Answer:

Explanation:

Within your template, the dependsOn element enables you to define one resource as a dependent on one or more resources. Its value can be a comma-separated list of resource names.

Box 1: ‘Microsoft.Network/networkInterfaces’

This resource is a virtual machine. It depends on two other resources:

Microsoft.Storage/storageAccounts

Microsoft.Network/networkInterfaces

Box 2: ‘Microsoft.Network/virtualNetworks/’

The dependsOn element enables you to define one resource as a dependent on one or more resources. The resource depends on two other resources:

Microsoft.Network/publicIPAddresses

Microsoft.Network/virtualNetworks

References:

https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-manager-tutorial-create­templates-with-dependent-resources

HOTSPOT

You plan to create a virtual machine as shown in the following exhibit.

Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point.

Reveal Solution Hide Solution

Correct Answer:

Explanation:

Box 1: is guaranteed to remain the same

OS disk type: Premium SSD

Premium SSD Managed Disks are high performance Solid State Drive (SSD) based Storage designed to support I/O intensive workloads with significantly high throughput and low latency. With Premium SSD Managed Disks, you can provision a persistent disk and configure its size and performance characteristics.

Box 2: secure enclaves

Virtual machine size: Standard_DC2s

DC-series virtual machines are a new family of VMs to protect the confidentiality and integrity of your data and code while it’s processed in Azure through the use of secure enclaves.

Incorrect:

Not dm-crypt: Azure Disk Encryption helps protect and safeguard your data to meet your organizational security and compliance commitments. It uses the BitLocker feature of Windows and the DM-Crypt feature of Linux to provide volume encryption for the OS and data disks of Azure virtual machines (VMs).

References:

https://docs.microsoft.com/en-us/azure/virtual-machines/windows/disks-types

https://azure.microsoft.com/en-us/pricing/details/virtual-machines/series/

HOTSPOT

A company runs multiple Windows virtual machines (VMs) in Azure. The IT operations department wants to apply the same policies as they have for on-premises VMs to the VMs running in Azure, including domain administrator permissions and schema extensions.

You need to recommend a solution for the hybrid scenario that minimizes the amount of maintenance required.

What should you recommend? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Reveal Solution Hide Solution

Correct Answer:

Explanation:

Box 1: Join the VMs to a new domain controller VM in Azure

Azure provides two solutions for implementing directory and identity services in Azure:

– (Used in this scenario) Extend your existing on-premises Active Directory infrastructure to Azure, by deploying a VM in Azure that runs AD DS as a Domain Controller. This architecture is more common when the on-premises network and the Azure virtual network (VNet) are connected by a VPN or ExpressRoute connection.

– Use Azure AD to create an Active Directory domain in the cloud and connect it to your on-premises Active Directory domain. Azure AD Connect integrates your on-premises directories with Azure AD.

Box 2: Set up VPN connectivity.

This architecture is more common when the on-premises network and the Azure virtual network (VNet) are connected by a VPN or ExpressRoute connection.

References:

https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/identity/

HOTSPOT

Your company has an Azure Container Registry named Registry1.

You have an Azure virtual machine named Serverl that runs Windows Server 2019.

From Serverl, you create a container image named image1.

You need to add image1 to Registry1.

Which command should you run on Server1? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Reveal Solution Hide Solution

Correct Answer:

Explanation:

An Azure container registry stores and manages private Docker container images, similar to the way Docker Hub stores public Docker images. You can use the Docker command-line interface (Docker CLI) for login, push, pull, and other operations on your container registry.

Reference:

https://docs.microsoft.com/en-us/azure/container-registry/container-registry-get-started-docker-cli https://docs.docker.com/engine/reference/commandline/push/

Your company has an office in Seattle. You have an Azure subscription that contains a virtual network named VNET1. You create a site-to-site VPN between the Seattle office and VNET1.

VNET1 contains the subnets shown in the following table.

You need to redirect all Internet-bound traffic from Subnet1 to the Seattle office.

What should you create?

Reveal Solution Hide Solution

HOTSPOT

You have an Azure subscription that contains the Azure SQL servers shown in the following table.

The subscription contains the elastic pools shown in the following table.

The subscription contains the Azure SQL databases shown in the following table.

For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Reveal Solution Hide Solution

Correct Answer:

Explanation:

Note: You cannot add databases from different servers into the same pool

Box 1: Yes

Pool2 contains DB2 but DB1 and DB2 are on Sql1. DB1 can thus be added to Pool2.

Box 2: Yes

Pool3 is empty.

Box 3: Yes

Pool1 contains DB1 but DB3 and DB1 are on Sql1. DB3 can thus be added to Pool1.

References:

https://docs.microsoft.com/en-us/azure/sql-database/sql-database-elastic-pool