Microsoft AZ-104 Microsoft Azure Administrator Exam Dumps and Practice Test Questions Set 14 Q196-210

Visit here for our full Microsoft AZ-104 exam dumps and practice test questions.

Question 196

You need to ensure that multiple virtual machines in a subscription are automatically patched with the latest OS updates without manual intervention. Which service should you use?

A) Azure Automation Update Management
B) Azure Monitor
C) Azure Policy
D) Azure Backup

Answer: A) Azure Automation Update Management

Explanation

Azure Automation Update Management is a comprehensive solution that enables administrators to schedule, deploy, and manage operating system updates across multiple virtual machines, whether they reside fully in Azure or in hybrid environments that include on-premises systems. This service is designed to support both Windows and Linux operating systems, offering a unified approach to patch management. By leveraging Update Management, administrators can ensure that all virtual machines remain up-to-date with the latest security patches, bug fixes, and feature updates, which is critical for maintaining both operational stability and security compliance.

One of the key features of Azure Automation Update Management is the ability to define maintenance windows. Administrators can schedule updates during periods that minimize disruption to business operations. This ensures that updates are applied in a controlled and predictable manner, reducing the risk of downtime or interference with critical workloads. In addition to scheduling, Update Management allows the execution of pre-scripts and post-scripts. Pre-scripts can perform tasks such as stopping dependent services or taking preliminary backups, while post-scripts can verify update installation, restart services, or trigger notifications. These scripting capabilities provide granular control over the update process and help automate complex operational tasks that would otherwise require manual intervention.

Update Management also provides detailed reporting and compliance tracking. Administrators can view which updates are missing, the update deployment status, and historical compliance trends across all managed virtual machines. This visibility enables proactive management of vulnerabilities and ensures that systems adhere to organizational patching policies. By automating the update process and providing real-time reporting, Update Management reduces human error, enhances operational efficiency, and helps organizations meet regulatory and security requirements.

It is important to distinguish Azure Automation Update Management from other Azure services that may seem related but serve different purposes. For instance, Azure Monitor collects metrics, logs, and alerts, providing extensive observability into system performance and health. While it can track patch compliance if integrated with Update Management, Azure Monitor by itself does not deploy or apply updates. Its role is limited to monitoring and alerting rather than performing maintenance tasks.

Similarly, Azure Policy enforces compliance rules on resource configurations. It can audit whether virtual machines meet a defined patching baseline or organizational policy, but it does not have the capability to install updates. Azure Backup, on the other hand, is focused on protecting data and VM states for recovery purposes. It ensures that data can be restored after failures or accidental deletions but does not manage or automate OS-level updates. Neither Azure Policy nor Azure Backup can replace the patch deployment and scheduling functionality that Update Management provides.

Therefore, for organizations seeking a reliable, automated solution to maintain OS patch compliance across multiple virtual machines, Azure Automation Update Management is the clear choice. It combines scheduling, automation, reporting, and compliance tracking into a single platform, reducing administrative overhead, improving security posture, and ensuring that virtual machines remain up-to-date without requiring manual intervention. This makes it the most suitable and effective solution for automated OS patching in both Azure-native and hybrid environments.

Question 197

You need to provide developers access to an Azure subscription for deploying resources, but you want to restrict their ability to delete existing resources. Which approach should you use?

A) Assign Contributor role
B) Assign Owner role
C) Assign Reader role
D) Assign Custom RBAC role with create and update permissions

Answer: D) Assign Custom RBAC role with create and update permissions

Explanation

In Azure, Role-Based Access Control (RBAC) is a mechanism that enables fine-grained management of access to resources. While built-in roles such as Owner, Contributor, and Reader provide broad sets of permissions, there are scenarios where these roles are either too permissive or too restrictive. One common example is the need to allow developers to deploy and modify resources in a development or staging environment while preventing them from deleting critical resources. In such cases, defining a custom RBAC role becomes the most appropriate solution.

A custom RBAC role can be tailored to include exactly the permissions needed for a specific task. In this scenario, the role can grant permissions to create and update resources while explicitly denying delete permissions. By restricting delete operations, organizations reduce the risk of accidental or malicious deletion of resources, which could disrupt production environments or critical development assets. Custom roles provide this granular control, allowing administrators to enforce the principle of least privilege—developers receive only the permissions necessary to perform their job functions and no more. This approach not only enhances security but also provides peace of mind to operations teams that critical resources are protected from unintended modifications.

Using a built-in Contributor role might initially seem like a potential solution because it allows full creation and modification of resources. However, the Contributor role also grants delete permissions, which conflicts with the requirement to prevent destructive actions. If developers were assigned this role, they could inadvertently or intentionally remove resources, potentially causing significant downtime or data loss. Thus, the Contributor role is overly permissive for scenarios where deletion must be restricted, making it unsuitable in environments where controlled access is critical.

Similarly, assigning the Owner role is even more permissive. The Owner role not only includes all read, create, update, and delete permissions but also allows management of access control, such as granting roles to other users. Providing developers with Owner-level access would give them unrestricted control over all resources in the assigned scope, far exceeding the intended permissions. This level of access is inappropriate in environments where operational governance and risk mitigation are priorities.

On the opposite end, the Reader role is far too restrictive. It allows users to view resources but does not permit creation, modification, or any type of operational changes. Developers assigned the Reader role would be unable to deploy new resources or update existing configurations, defeating the purpose of giving them access to a development environment. While it is safe from a security standpoint, it does not support the functional requirements of developers who need to actively manage resources.

By defining a custom RBAC role with explicit create and update permissions while denying delete operations, administrators achieve an ideal balance. Developers gain the flexibility to deploy and update resources necessary for their tasks, while organizations maintain control over resource deletion and access management. This method ensures compliance with internal governance policies, reduces operational risk, and promotes a secure and efficient development workflow. Custom roles, therefore, provide the precision, flexibility, and safety needed in scenarios where standard built-in roles are either too permissive or too restrictive.

Question 198

You need to replicate Azure Storage account data to another region for disaster recovery. Which feature should you use?

A) Geo-Redundant Storage (GRS)
B) Locally Redundant Storage (LRS)
C) Zone-Redundant Storage (ZRS)
D) Azure Backup

Answer: A) Geo-Redundant Storage (GRS)

Explanation

Geo-Redundant Storage automatically replicates data to a secondary region hundreds of miles away from the primary region. This ensures business continuity if the primary region suffers a catastrophic outage. It maintains three copies in the primary region and three copies in the secondary region asynchronously. This approach provides resilience against regional failures and satisfies disaster recovery requirements.

Locally Redundant Storage keeps multiple copies of data within a single region. It protects against local hardware failures but does not safeguard against regional outages, making it insufficient for cross-region disaster recovery.

Zone-Redundant Storage replicates data across availability zones within the same region, protecting against data center-level failures. However, it does not provide replication to a geographically separate region and therefore cannot fully support disaster recovery in case of regional outages.

Azure Backup provides scheduled backups for point-in-time recovery but does not provide real-time replication to a secondary region. Recovery from backups typically requires longer restore times and does not ensure continuous availability.

Thus, Geo-Redundant Storage is the only solution that meets the requirement of replicating storage data to a different region for disaster recovery.

Question 199

You need to provide a virtual network with secure access to Azure SQL Database over a private connection. Which configuration should you implement?

A) Private Endpoint
B) Public Endpoint
C) Service Bus
D) Azure ExpressRoute

Answer: A) Private Endpoint

Explanation

A Private Endpoint in Azure provides a secure and reliable way to connect to Azure SQL Database by assigning it a private IP address within a virtual network. This configuration enables virtual machines and other resources inside the same virtual network to communicate with the database over a private IP address, without exposing it to the public internet. By keeping traffic entirely within Azure’s backbone network, Private Endpoints significantly reduce the attack surface, ensuring that sensitive data remains protected and network communication is isolated from external threats. In addition to secure connectivity, Private Endpoints integrate with Azure’s DNS system to ensure that the database hostname resolves to the private IP address, simplifying access for internal applications while maintaining security and compliance. This makes Private Endpoints particularly suitable for environments where regulatory standards, data protection, or internal policies require that resources do not traverse the public internet.

In contrast, a public endpoint exposes an Azure SQL Database to the internet by assigning it a publicly routable IP address. While public endpoints allow access from anywhere, they introduce significant security risks. They increase the potential attack surface because anyone on the internet could attempt to connect to the database, requiring additional measures such as firewall rules, network restrictions, and strong authentication to mitigate threats. For organizations that require private, secure access within a controlled network environment, relying on a public endpoint is not acceptable. Exposing a production database to the internet unnecessarily increases risk and conflicts with best practices for securing sensitive workloads.

Azure Service Bus, while a valuable Azure service, serves an entirely different purpose. It is a messaging platform that facilitates decoupled communication between applications, supporting scenarios such as queues, topics, and event-driven architectures. Service Bus does not provide network-level isolation for databases, nor does it allow secure private connectivity to Azure SQL Database. While Service Bus is important for designing scalable and resilient applications, it does not solve the requirement of keeping SQL Database traffic within a virtual network or preventing exposure to the public internet.

Azure ExpressRoute is another option for private connectivity, offering dedicated, high-bandwidth connections between on-premises networks and Azure data centers. ExpressRoute ensures that traffic between on-premises resources and Azure does not traverse the public internet, providing low-latency and highly secure connectivity. However, ExpressRoute is primarily intended for hybrid environments where on-premises systems need private access to Azure resources. It is unnecessary for scenarios where both the virtual machines and the SQL Database are already hosted within Azure. Using ExpressRoute solely to connect VMs to a database in the same Azure region would be excessive, complex, and cost-inefficient compared to simply using a Private Endpoint.

Considering these options, a Private Endpoint is the most appropriate and efficient solution for securing network access to Azure SQL Database. It ensures that the database remains accessible only within the virtual network, maintains traffic within Azure’s secure backbone, supports DNS resolution for internal connectivity, and significantly reduces potential security risks. For organizations focused on internal network security, compliance, and protecting sensitive data, configuring a Private Endpoint provides the ideal balance of security, simplicity, and cost-effectiveness.

Question 200

You need to ensure compliance by enforcing that all Azure virtual machines are encrypted at rest using platform-managed keys. Which service can enforce this?

A) Azure Policy
B) Azure Monitor
C) Azure Automation
D) Azure Advisor

Answer: A) Azure Policy

Explanation

Azure Policy is a governance tool designed to help organizations enforce compliance across their Azure resources by applying rules and standards consistently. One common requirement is to ensure that all virtual machines are encrypted at rest to protect sensitive data and meet regulatory or organizational security standards. With Azure Policy, administrators can define policies that automatically enforce encryption configurations for virtual machines using platform-managed keys. Once a policy is assigned to a subscription, resource group, or management group, it continuously evaluates the resources against the defined rules. Any virtual machine that is not encrypted at rest can be flagged as non-compliant, providing administrators with visibility into potential security gaps. Additionally, Azure Policy can trigger remediation tasks that automatically apply encryption to non-compliant VMs, ensuring that all resources adhere to the organization’s encryption requirements without relying solely on manual intervention. This automated enforcement helps maintain a secure and consistent environment while reducing the risk of data exposure.

Azure Monitor, while a powerful tool for operational visibility, serves a different purpose. It collects logs, metrics, and telemetry data from Azure resources and provides insights into performance, health, and activity trends. Administrators can configure alerts based on specific events or thresholds, allowing proactive monitoring and troubleshooting. However, Azure Monitor does not have the capability to enforce configuration standards or compliance rules. It cannot automatically apply encryption to virtual machines or ensure that all resources adhere to an organization’s security policies. Its role is limited to observation, alerting, and reporting rather than enforcing rules or taking corrective action.

Azure Automation provides capabilities for running scripts and scheduling tasks across Azure and hybrid environments. While Automation can be used to remediate compliance issues if integrated with appropriate scripts or runbooks, it does not inherently enforce compliance. Without Azure Policy defining the standards, Automation alone cannot identify which virtual machines require encryption or ensure that the correct settings are applied consistently. Essentially, Automation is a tool for executing tasks, but it requires policies or external triggers to define what needs to be enforced, making it insufficient as a standalone compliance solution.

Azure Advisor is another service that complements governance but serves primarily as a recommendation engine. It analyzes resource configurations and usage patterns and provides best practice suggestions to optimize performance, security, cost, and reliability. For example, Azure Advisor might highlight unencrypted virtual machines or recommend enabling encryption to enhance security. However, Advisor only provides recommendations; it does not enforce policies or apply changes automatically. Organizations still need to take manual action or integrate Advisor’s recommendations with other tools to achieve compliance.

Considering these options, Azure Policy is the service specifically designed to enforce compliance requirements such as encrypting virtual machines at rest. It provides continuous evaluation, automated remediation, and centralized auditing, ensuring that resources adhere to organizational standards. By using Azure Policy, administrators can maintain a consistent security posture, minimize risks associated with unencrypted data, and meet regulatory or internal compliance requirements effectively. Unlike Azure Monitor, Automation, or Advisor, Azure Policy combines visibility, enforcement, and remediation into a single framework, making it the ideal choice for ensuring that all virtual machines remain encrypted at rest and fully compliant.

Question 201

You need to restrict network access to an Azure SQL Database so only traffic from a specific subnet is allowed. Which feature should you configure?

A) Virtual Network Service Endpoint
B) Public Endpoint
C) Azure Front Door
D) Network Security Group

Answer: A) Virtual Network Service Endpoint

Explanation

Virtual Network Service Endpoints provide a secure and efficient way to connect Azure virtual networks to specific Azure services, such as SQL Database, over the Azure backbone network. By enabling a service endpoint for a designated subnet, administrators ensure that traffic to the service originates only from that subnet. This mechanism extends the identity of the virtual network to the Azure service, which allows the service to recognize and trust traffic coming from the approved subnet. As a result, access to the service is restricted, reducing the risk of unauthorized connections from the internet or other networks. Using service endpoints ensures that all communication remains within Azure’s secure network infrastructure, providing both enhanced security and compliance for sensitive workloads. This setup also simplifies network architecture by avoiding the need for complex VPNs or additional network appliances to control access to platform services.

In contrast, a public endpoint exposes an Azure SQL Database to the internet through a publicly routable IP address. While public endpoints can be secured using firewall rules and other access controls, they inherently increase the attack surface because the database becomes reachable from outside Azure. This exposure conflicts with the requirement to limit access to a specific subnet within a virtual network. Public endpoints allow connectivity from any authorized IP address, which may include sources outside the intended subnet, thereby weakening the security posture and potentially violating internal policies or compliance requirements.

Azure Front Door serves a completely different purpose. It is an application delivery network that provides global routing, load balancing, and performance optimization for HTTP and HTTPS traffic. While Front Door improves performance, availability, and security for web applications by distributing traffic across multiple regions, it does not provide the ability to restrict access to a SQL Database at the network or subnet level. Front Door operates at the application layer and cannot enforce connectivity policies for Azure platform services, making it unsuitable for scenarios where subnet-specific access is required.

Network Security Groups, or NSGs, can filter inbound and outbound traffic at the subnet or network interface level. They are highly effective for controlling traffic to virtual machines and other resources within a virtual network. However, NSGs cannot directly secure Azure platform services such as SQL Database because these services are managed by Azure and do not reside within the virtual network itself. While NSGs can help secure the virtual network perimeter, they cannot enforce that only a specific subnet can access a PaaS service endpoint. Therefore, relying solely on NSGs does not achieve the goal of restricting service access to a designated subnet.

Considering all available options, Virtual Network Service Endpoints provide the most appropriate solution for restricting Azure SQL Database access to a specific subnet. They allow the service to recognize traffic as coming from an approved virtual network, maintain all traffic within Azure’s backbone for security and compliance, and prevent exposure to the general internet. This approach ensures that only authorized subnets can interact with the database while simplifying network configuration and enhancing overall security. For organizations aiming to enforce subnet-level access controls for Azure platform services, enabling a Virtual Network Service Endpoint is the most secure and effective solution.

Question 202

You need to provide an on-premises application secure, private access to Azure Storage without exposing it to the internet. Which solution should you implement?

A) Azure ExpressRoute with private peering
B) Shared Access Signature
C) Public Endpoint
D) Azure Traffic Manager

Answer: A) Azure ExpressRoute with private peering

Explanation

Azure ExpressRoute is a service that provides a private, dedicated connection between an organization’s on-premises network and Microsoft Azure. Unlike standard internet connections, ExpressRoute traffic does not traverse the public internet, which ensures that data remains secure and private. This private connectivity is particularly important for enterprises that handle sensitive data or operate under strict compliance regulations, as it minimizes exposure to potential external threats. By using private peering, ExpressRoute allows traffic from on-premises systems to reach Azure services such as Azure Storage entirely over the private network. This ensures predictable performance with lower latency and consistent throughput, which is critical for applications that require reliable access to storage or other Azure services. Organizations can therefore maintain a high level of security, meet regulatory compliance requirements, and improve overall operational efficiency by keeping data transfer within a trusted, controlled network path.

In comparison, a Shared Access Signature (SAS) is a token-based mechanism that allows limited, time-bound access to Azure Storage resources. While SAS is useful for providing temporary or delegated access to blobs, files, queues, or tables, it does not provide a secure network path. If SAS is used with public endpoints, the traffic will still traverse the public internet, exposing data to potential interception or unauthorized access. SAS controls authorization and permissions at the storage level, but it does not ensure the privacy or security of the underlying network connection from on-premises to Azure. Therefore, while SAS can control who can access data, it cannot guarantee that access is happening over a private, secure link, which is a critical requirement in scenarios demanding end-to-end network isolation.

A public endpoint for Azure Storage exposes the resource to the internet with a publicly routable IP address. Although access can be restricted using firewall rules or virtual network service endpoints, traffic inherently passes over public networks, which increases the risk of interception and exposure to potential attacks. Public endpoints are contrary to the requirement of maintaining private, secure connectivity from on-premises networks, as they do not provide isolation from internet traffic and rely on additional security configurations to mitigate risks.

Azure Traffic Manager is another service often considered for managing connectivity. It operates as a global load-balancing and traffic-routing solution for HTTP and HTTPS endpoints. Traffic Manager ensures availability and performance for internet-facing applications by routing client requests to the most appropriate backend. However, it functions entirely at the application layer and does not provide private network connectivity. It cannot secure Azure Storage access from on-premises systems or restrict traffic to a dedicated private path. Traffic Manager is therefore not suitable for scenarios that require private, network-level access to Azure Storage.

Given these considerations, ExpressRoute with private peering is the optimal solution for organizations that need secure, private access to Azure Storage from on-premises networks. It provides a dedicated, private connection that bypasses the public internet, delivers predictable performance, ensures compliance with regulatory standards, and reduces security risks associated with public exposure. For scenarios requiring a secure and reliable link between on-premises systems and Azure services, ExpressRoute with private peering is the most effective and recommended approach.

Question 203

You need to ensure that a critical Azure VM can automatically recover from unplanned outages. Which feature should you implement?

A) Availability Set
B) Availability Zone
C) Azure Backup
D) Azure Site Recovery

Answer: D) Azure Site Recovery

Explanation

Azure Site Recovery is a cloud-based disaster recovery service designed to ensure business continuity by replicating virtual machines and orchestrating failovers in the event of outages or disasters. It enables organizations to replicate workloads from a primary location to a secondary region or availability zone, providing a reliable solution for maintaining operations during unplanned disruptions. By continuously replicating data and configurations, Azure Site Recovery ensures that virtual machines remain up-to-date at the recovery site, allowing rapid restoration of services when failures occur. This proactive approach minimizes downtime and helps organizations meet recovery time objectives and recovery point objectives, which are critical metrics for business continuity planning.

One of the key features of Azure Site Recovery is its ability to automate the failover process. Administrators can define recovery plans that include the sequence of virtual machine startup, network configurations, and custom scripts, ensuring that all dependencies are considered during recovery. This level of orchestration reduces the need for manual intervention and accelerates the recovery process, allowing critical services to resume quickly after a disruption. Additionally, Azure Site Recovery supports test failovers, enabling administrators to validate disaster recovery strategies without impacting production workloads. This ensures that recovery procedures are functional, effective, and compliant with organizational standards before an actual outage occurs.

In comparison, an Availability Set provides redundancy within a single region by distributing virtual machines across fault domains and update domains. Fault domains protect against hardware failures by ensuring that not all VMs are hosted on the same physical server rack, while update domains prevent simultaneous downtime during planned maintenance. Although Availability Sets increase availability and reduce the risk of localized hardware or maintenance failures, they are limited to a single region and cannot provide protection against large-scale outages or regional disasters. Therefore, Availability Sets alone are insufficient for comprehensive disaster recovery planning.

Availability Zones offer a higher level of availability by distributing virtual machines across physically separate zones within the same region. This configuration mitigates the risk of data center-level failures and ensures that workloads remain operational even if a single zone experiences an outage. However, Availability Zones do not extend protection beyond the region. In the case of a regional disaster, such as a natural calamity or major infrastructure failure, workloads may still be affected, making Availability Zones inadequate for scenarios requiring cross-region disaster recovery.

Azure Backup, while an essential tool for protecting data, serves a different purpose. It provides point-in-time recovery of virtual machine data by creating backups that can be restored in the event of corruption or accidental deletion. However, Azure Backup does not maintain continuous availability of virtual machines, nor does it automate failover processes. Recovery from backup can take significant time, depending on the size of the workload and restoration procedures, which may not meet the stringent recovery objectives required for mission-critical systems.

Given these options, Azure Site Recovery emerges as the most suitable solution for ensuring automatic virtual machine recovery during unplanned outages. By providing continuous replication, automated failover, test failover capabilities, and orchestration of recovery plans, it delivers comprehensive disaster recovery that Availability Sets, Availability Zones, or Azure Backup alone cannot achieve. For organizations seeking to minimize downtime, protect critical workloads, and maintain business continuity in the face of unexpected disruptions, Azure Site Recovery is the recommended and most effective solution.

Question 204

You need to provide time-limited administrative access to a virtual machine without exposing it to the internet. Which service should you use?

A) Just-In-Time VM Access
B) Network Security Group
C) Azure Firewall
D) Azure Bastion

Answer: A) Just-In-Time VM Access

Explanation

Just-In-Time VM Access allows administrators to request temporary access to virtual machines for a defined period. Ports such as RDP or SSH are opened only for the approved time and automatically closed afterward. This reduces the attack surface and ensures secure, time-bound access without permanent exposure to the internet.

Network Security Group can restrict inbound or outbound traffic based on IP, port, and protocol but cannot provide time-limited access. Manual changes would be required, which is less secure and not automated.

Azure Firewall provides centralized traffic filtering and threat protection but does not handle temporary or scheduled access to virtual machines.

Azure Bastion enables secure RDP/SSH access over TLS directly through the Azure portal, removing the need for public IPs. However, it does not inherently provide time-bound access; permanent portal access remains available to anyone with credentials.

Thus, Just-In-Time VM Access is the correct service because it provides controlled, temporary administrative access to VMs without exposing them permanently.

Question 205

You need to protect sensitive data in an Azure Storage account and ensure you manage the encryption keys. Which approach should you use?

A) Customer-Managed Keys in Azure Key Vault
B) Platform-Managed Keys
C) Azure Disk Encryption
D) Transparent Data Encryption

Answer: A) Customer-Managed Keys in Azure Key Vault

Explanation

Customer-Managed Keys (CMK) in Azure provide organizations with full control over the encryption of their data stored in Azure services, including Azure Storage. With CMK, the encryption keys are created, stored, and managed by the customer within Azure Key Vault. This approach ensures that organizations maintain ownership and control over the keys used to protect their sensitive data. By leveraging CMK, organizations can define key rotation schedules, revoke keys if necessary, and audit key usage, all of which are critical capabilities for meeting regulatory, compliance, and corporate security requirements. For businesses that handle sensitive or regulated information, such as financial, healthcare, or government data, CMK provides the assurance that they retain control over the cryptographic keys, aligning with internal policies and external regulations.

Azure Key Vault acts as a secure repository for storing these keys. It is designed to protect keys against unauthorized access and provides detailed auditing features that log all key operations. Through Key Vault, organizations can implement automated or manual key rotation to enhance security over time, ensuring that encryption keys are refreshed periodically according to best practices. Additionally, Key Vault allows organizations to revoke keys if they detect potential compromise or need to retire a key, providing an additional layer of control over encrypted data. These features are essential for compliance frameworks that require explicit key management and accountability for access to sensitive information.

In contrast, Platform-Managed Keys provide encryption automatically for Azure Storage but are fully managed by Microsoft. While platform-managed encryption ensures that all data is encrypted at rest, the keys are not controlled by the customer. This means organizations cannot rotate, revoke, or audit the keys directly, limiting their ability to demonstrate compliance with certain regulatory requirements. Platform-managed keys are suitable for general security purposes but do not satisfy scenarios where strict key control is necessary, particularly for industries that require verifiable control and auditing over encryption keys.

Azure Disk Encryption, another Azure security feature, encrypts virtual machine OS and data disks using technologies such as BitLocker for Windows or DM-Crypt for Linux. While Disk Encryption is valuable for securing virtual machine data at rest, it does not extend to Azure Storage account objects such as blobs, tables, queues, or files. As a result, it does not meet the requirement for controlling encryption at the storage account level.

Similarly, Transparent Data Encryption (TDE) automatically encrypts database data at rest, particularly for Azure SQL Database and SQL Managed Instances. While TDE protects database workloads and can be combined with CMK for customer control, by default it uses platform-managed keys. TDE is specific to database workloads and does not apply to general Azure Storage objects, making it insufficient for scenarios that require customer-managed control over storage encryption keys.

Considering these options, using Customer-Managed Keys in Azure Key Vault is the most appropriate solution for organizations that need to encrypt data while maintaining full control over encryption keys. CMK ensures that data is securely encrypted, meets compliance and regulatory requirements, and provides the organization with the ability to rotate, revoke, and audit keys according to their governance policies. By implementing CMK, organizations achieve both robust data protection and full key ownership, which is critical for sensitive and regulated workloads in Azure.

Question 206

You need to ensure that only specific approved virtual machine images can be deployed in a subscription. Which solution should you implement?

A) Azure Policy – Allowed VM Images
B) Azure Blueprints
C) Azure Monitor
D) Network Security Group

Answer: A) Azure Policy – Allowed VM Images

Explanation

Azure Policy is a governance tool in Microsoft Azure that enables organizations to enforce rules and standards across their cloud environment, ensuring compliance with internal policies, regulatory requirements, and security guidelines. One important use case for Azure Policy is the restriction of virtual machine (VM) deployments to approved images. By defining specific policies that allow only certain VM images, administrators can control which operating systems, versions, or pre-approved configurations are deployed within their subscriptions. This ensures that all virtual machines comply with organizational standards, reducing the risk of deploying unverified, unsupported, or insecure images that could compromise security or operational stability.

When a VM deployment request is made, Azure Policy evaluates the request against the defined rules. If the image specified in the deployment is not included in the allowed list, the request is automatically denied. This automated enforcement removes the need for manual checks and interventions, ensuring that policies are consistently applied across all teams and subscriptions. It also reduces human error, which can often lead to deployment of unauthorized or potentially vulnerable virtual machines. By enforcing the use of approved images, Azure Policy helps organizations maintain a standardized environment, making management, monitoring, and compliance reporting more efficient and reliable.

Azure Blueprints, while also a powerful tool for governance and compliance, function differently. Blueprints allow administrators to define resource templates, configurations, and sets of policies to ensure consistent deployment of environments across multiple subscriptions or resource groups. However, Blueprints do not automatically prevent users from deploying VM images outside of the predefined templates. Their primary focus is on consistency in deploying resources according to a specific design, rather than enforcing compliance in real-time at the point of VM creation. While Blueprints can include policies as part of their deployment, they do not themselves enforce policy evaluation automatically for ad-hoc deployments.

Azure Monitor is another tool within the Azure ecosystem that provides extensive capabilities for logging, metrics collection, and performance monitoring. It enables administrators to track resource utilization, detect anomalies, and set alerts for operational issues. Despite its critical role in monitoring and observability, Azure Monitor does not have the capability to restrict the deployment of virtual machines or enforce compliance rules on resource configurations. It is purely a diagnostic and monitoring service and cannot prevent users from deploying non-compliant VM images.

Network Security Groups (NSGs) provide another layer of control by filtering inbound and outbound traffic to resources at the subnet or network interface level. While NSGs are effective for controlling network access and enhancing security, they have no mechanism for influencing what virtual machine images are used or enforcing deployment standards. NSGs operate at the network layer, rather than at the resource configuration or governance level.

Azure Policy is the correct and most effective mechanism for enforcing compliance regarding VM image usage. By defining rules that restrict deployments to approved images, administrators can ensure that all virtual machines meet organizational standards, maintain security, and adhere to compliance requirements. Unlike Blueprints, Monitor, or NSGs, Azure Policy evaluates deployment requests in real-time and automatically denies non-compliant images, providing a consistent, enforceable governance framework that protects the integrity and security of the cloud environment.

Question 207

You need to ensure that Azure virtual machines can be managed centrally for monitoring, patching, and configuration. Which service should you enable?

A) Azure Arc
B) Azure Bastion
C) Azure Backup
D) Azure Traffic Manager

Answer: A) Azure Arc

Explanation

Azure Arc extends Azure management capabilities to on-premises, multi-cloud, and hybrid virtual machines. It allows central monitoring, configuration management, inventory, policy enforcement, and update management. It enables consistent operational control across diverse environments.

Azure Bastion provides secure RDP/SSH access but does not manage updates, monitoring, or configuration centrally.

Azure Backup protects VM data but does not provide monitoring, patching, or configuration management.

Azure Traffic Manager routes traffic globally for availability and performance but has no role in managing virtual machines.

Thus, Azure Arc is the correct solution for centralized VM management across multiple environments.

Question 208

You need to monitor the performance and health of an application deployed across multiple Azure virtual machines. Which service should you use?

A) Azure Application Insights
B) Azure Monitor Metrics
C) Azure Security Center
D) Azure Advisor

Answer: A) Azure Application Insights

Explanation

Azure Application Insights provides deep application-level telemetry, including request rates, response times, dependency tracking, exceptions, and custom events. It enables root-cause analysis, performance monitoring, and health tracking for distributed applications running across multiple VMs.

Azure Monitor Metrics provides metrics and performance data at the infrastructure level. While useful for VM CPU, memory, and disk usage, it does not provide detailed application-level insights.

Azure Security Center focuses on threat detection, vulnerability assessment, and security posture management. It does not monitor application performance.

Azure Advisor provides recommendations to optimize cost, performance, and security but does not actively monitor application runtime health or performance.

Therefore, Application Insights is the correct service for application performance and health monitoring.

Question 209

You need to enforce encryption for all newly deployed Azure virtual machines in a subscription. Which service should you use?

A) Azure Policy
B) Azure Monitor
C) Azure Backup
D) Network Security Group

Answer: A) Azure Policy

Explanation

Azure Policy can enforce encryption requirements at deployment time. Administrators can create a policy that ensures all newly created virtual machines have OS and data disks encrypted. Any non-compliant deployment is denied or remediated automatically. This ensures organizational compliance with encryption standards.

Azure Monitor collects metrics and logs but does not enforce deployment compliance or encryption requirements.

Azure Backup provides recovery and restore options but does not enforce encryption at deployment.

Network Security Groups filter network traffic and have no impact on encryption or compliance settings.

Thus, Azure Policy is the correct choice to ensure encryption is enforced for new VMs.

Question 210

You need to ensure that Azure virtual machines can be scaled automatically based on CPU usage. Which service should you configure?

A) Azure Virtual Machine Scale Sets
B) Availability Set
C) Azure Automation Runbook
D) Azure Monitor Logs

Answer: A) Azure Virtual Machine Scale Sets

Explanation

Azure Virtual Machine Scale Sets allow horizontal scaling of identical VMs based on defined metrics such as CPU usage or memory. Autoscaling rules can increase or decrease the number of instances automatically, ensuring performance and cost efficiency for variable workloads.

Availability Set distributes VMs across fault and update domains to increase availability but does not automatically scale VM instances based on metrics.

Azure Automation Runbook can automate tasks, including manual scaling, but does not provide built-in metric-based autoscaling.

Azure Monitor Logs collects telemetry and metrics but does not automatically scale VMs. It can trigger alerts or actions, but scaling requires integration with Scale Sets or automation.

Therefore, Virtual Machine Scale Sets are the correct service for automatic scaling based on performance metrics.