You have an Azure subscription that contains a virtual network named VNET1. VNET1 contains the subnets shown in the following table.

Each virtual machine uses a static IP address.
You need to create network security groups (NSGs) to meet following requirements:
* Allow web requests from the internet to VM3, VM4, VM5, and VM6.
* Allow all connections between VM1 and VM2.
* Allow Remote Desktop connections to VM1.
* Prevent all other network traffic to VNET1.
What is the minimum number of NSGs you should create?

• A.1
• B.3
• C.4
• D.12

Comment: *

Name: *

Email: *

Verification: *

You have an Azure subscription that contains two virtual networks named VNet1 and VNet2. VNet1 contains two virtual machines named VM1 and VM2. VM1 and VM2 host an application named App1.
The resources on VNet2 only access App1 through the internal network.
You need to ensure that inbound traffic from VNet2 to App1 is evenly distributed between VM1 and VM2.
The solution must ensure that the virtual machines are NOT exposed to the internet.
What should you use?

• A.Azure Application Gateway
• B.Azure Load Balancer
• C.Azure Front Door
• D.Azure Traffic Manager

Comment: *

Name: *

Email: *

Verification: *

You have the Azure virtual machines shown in the following table:

You have a Recovery Services vault that protects VM1 and VM2.
You need to protect VM3 and VM4 by using Recovery Services.
What should you do first?

• A.Create a new Recovery Services vault
• B.Create a storage account
• C.Configure the extensions for VM3 and VM4
• D.Create a new backup policy

Comment: *

Name: *

Email: *

Verification: *

Hotspot Question
You have an Azure subscription named Sub1 that contains the resources shown in the following table.

The subscription contains the users shown in the following table.

VNet2 was created by using the following cmdlet.

For VNet2, Access control (IAM) settings are configured as shown in the following exhibit.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

Correct Answer:

Explanation:
Box 1: No
No - Admin1 can modify the IP address space of VNet2.
Admin1 is a Network Contributor with scope of Sub1.
VNet2 is in RG2.
RG2 is in Sub1.
For VNet2 the IAM settings are Deny assignment.
This will deny Admin1 to modify the IP address space of VNet2.
Note:
Similar to a role assignment, a deny assignment attaches a set of deny actions to a user, group, or service principal at a particular scope for the purpose of denying access. Deny assignments block users from performing specific Azure resource actions even if a role assignment grants them access.
Box 2: Yes
Yes - Admin2 can delete Subnet2.
Admin2 is Contributor for RG2.
VNet2 is a virtual network in RG2. VNet2 contains Subnet2.
A user with the Contributor role for an Azure resource (such as a Virtual Network) has the necessary permissions to delete a subnet, provided specific conditions are met.
Box 3: No
No - Admin3 can delete VNet2.
Admin3 is the Owner of VNet2.
VNet2 was created by the command New-AzResourceGroupDeploymentStack with parameter - DenySettingsMode set to DenyDelete.
If a Virtual Network is managed by an Azure Deployment Stack created with DenySettingsMode set to DenyDelete, even a user with the Owner role cannot delete that Virtual Network.
The behavior is governed by the following mechanisms:
Deny Assignments: Deployment stacks create deny assignments on managed resources. Deny assignments take precedence over any allow permissions granted via Role-Based Access Control (RBAC), effectively blocking the operation regardless of the user's role.
Protection Scope: The DenyDelete mode specifically prohibits delete operations on all managed resources within the stack to prevent accidental or unauthorized removal.
Permissions Required to Override: To delete the resource, a user must have specific permissions to manage the deployment stack itself (such as the Azure Deployment Stack Owner role) to either update the stack's deny settings or delete the stack entirely.
Reference:
https://learn.microsoft.com/en-us/azure/role-based-access-control/deny-assignments
https://techcommunity.microsoft.com/blog/azuregovernanceandmanagementblog/arm-deployment-stacks-now-ga/4145469

Comment: *

Name: *

Email: *

Verification: *

You have a virtual network named VNET1 that contains the subnets shown in the following table:

You have two Azure virtual machines that have the network configurations shown in the following table:

For NSG1, you create the inbound security rule shown in the following table:

For NSG2, you create the inbound security rule shown in the following table:

For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

Correct Answer:

Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/security-overview

Comment: *

Name: *

Email: *

Verification: *