You have an Azure subscription that contains a user named User1 and a storage account named storage 1. The storage1 account contains the resources shown in the following table.

User1 is assigned the following roles for storage 1:
* Storage Blob Data Reader
* Storage Table Data Contributor
* Storage File Data SMB Share Contributor
For storage1, you create a shared access signature (SAS) named SAS1 that has the settings shown in the following exhibit. (Click the Exhibit tab.)

To which resources can User1 write by using SAS1 and key1? To answer, select the appropriate options in the answer area.

Correct Answer:

Explanation:

In this scenario, the Azure subscription contains a storage account (storage1) with three resources:
container1 (Blob container)
folder1 (File share)
Table1 (Table storage)
User1's assigned roles:
Storage Blob Data Reader # Read-only access to Blob data (cannot write).
Storage Table Data Contributor # Read, write, and delete access to Table data.
Storage File Data SMB Share Contributor # Read and write access to Azure File shares.
Now, let ' s analyze access using key1 and SAS1.
1## Access via key1
When using an account key, access is granted to all services within the storage account-Blob, File, Queue, and Table, because the key authenticates at the account level.
However, the question specifically asks:
"To which resources can User1 write by using SAS1 and key1?"
While account keys grant access to all resources, write permissions depend on the assigned roles of User1 for that account.
User1 can:
Write to the File share (folder1) because they are a Storage File Data SMB Share Contributor.
Write to the Table (Table1) because they are a Storage Table Data Contributor.
Cannot write to the Blob container (container1) because they only have the Storage Blob Data Reader role, which is read-only.
# Therefore, using key1, User1 can write to folder1 and Table1 only.
2## Access via SAS1
The Shared Access Signature (SAS) shown in the exhibit specifies:
Allowed services: Blob, File, and Table (Queue not selected).
Allowed permissions: Read, Write, Delete, List, Add, Create, and Update.
Start and expiry: Valid from 2022 to 2030.
Protocols: HTTPS only.
SAS defines data plane access, allowing specific operations within the defined services, regardless of the user' s assigned Azure roles.
Therefore, the SAS allows:
Access to Blob service # affects container1
Access to File service # affects folder1
Access to Table service # affects Table1
However, the question specifically distinguishes SAS1 and key1. Because SAS1 defines services explicitly, the question's options match how Azure limits SAS to only those selected services.
Hence, SAS1 allows write access to:
Table1 (Table service)
container1 (Blob service)
# Therefore, using SAS1, User1 can write to Table1 and container1 only.
# Final Verified answer:
Access Method
Write Access To
key1
folder1 and Table1 only
SAS1
Table1 and container1 only
Reference Extract (Azure Documentation):
"A shared access signature (SAS) grants limited access rights to Azure Storage resources for a specified time and set of permissions. The permissions are defined per service selected (Blob, File, Queue, Table)."
"Using an account key provides full access to all data objects in the storage account, but effective access may still be limited by assigned RBAC roles if role-based access control is enforced."

Comment: *

Name: *

Email: *

Verification: *

You have an Azure subscription named Subscription1. Subscription1 contains the resources in the following table.

In Azure, you create a private DNS zone named adatum.com. You set the registration virtual network to VNet2. The adatum.com zone is configured as shown in the following exhibit.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

Correct Answer:

Comment: *

Name: *

Email: *

Verification: *

You need to recommend a solution for App1. The solution must meet the technical requirements. What should you include in the recommendation? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Correct Answer:

Explanation

This reference architecture shows how to deploy VMs and a virtual network configured for an N-tier application, using SQL Server on Windows for the data tier.

Scenario: You have a public-facing application named App1. App1 is comprised of the following three tiers:
* A SQL database
* A web front end
* A processing middle tier
Each tier is comprised of five virtual machines. Users access the web front end by using HTTPS only.
* Technical requirements include:
* Move all the virtual machines for App1 to Azure.
* Minimize the number of open ports between the App1 tiers.
References: https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/n-tier/n-tier-sql-server

Comment: *

Name: *

Email: *

Verification: *

You plan to deploy route-based Site-to-Site VPN connections between several on-premises locations and an Azure virtual network. Which tunneling protocol should you use?

• A.IKEv1
• B.L2TP
• C.|KEv2
• D.PPTP

Comment: *

Name: *

Email: *

Verification: *

Hotspot Question
You have a Microsoft Entra tenant that contains the users shown in the following table.

For which users can you modify the User type and Usage location settings? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Correct Answer:

Explanation:
Box 1: User1 and User3 only
You must use Windows Server Active Directory to update the identity, contact info, or job info for users whose source of authority is Windows Server Active Directory.
Box 2: User1, User2, and User3
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-users-profile-azure-portal

Comment: *

Name: *

Email: *

Verification: *