Correct Answer:

At a high level, an import job involves the following steps:

Step 1: Attach an external disk to Server1 and then run waimportexport.exe

Determine data to be imported, number of drives you need, destination blob location for your data in Azure storage.

Use the WAImportExport tool to copy data to disk drives. Encrypt the disk drives with BitLocker.

Step 2: From the Azure portal, create an import job.

Create an import job in your target storage account in Azure portal. Upload the drive journal files.

Step 3: Detach the external disks from Server1 and ship the disks to an Azure data center.

Provide the return address and carrier account number for shipping the drives back to you.

Ship the disk drives to the shipping address provided during job creation.

Step 4: From the Azure portal, update the import job

Update the delivery tracking number in the import job details and submit the import job.

The drives are received and processed at the Azure data center.

The drives are shipped using your carrier account to the return address provided in the import job.

Reference:

https://docs.microsoft.com/en-us/azure/storage/common/storage-import-export-service

Correct Answer:

Box 1: No

Virtual networks are not allowed at the root and is inherited. Deny overrides allowed.

Box 2: No

Box 3: Yes

Subscriptions can be moved between Management Groups provided the user has the required RBAC permissions.

Correct Answer:

Box 1: add an address space Your IaaS virtual machines (VMs) and PaaS role instances in a virtual network automatically receive a private IP address from a range that you specify, based on the address space of the subnet they are connected to. We need to add the 192.168.1.0/24 address space.

Box 2: add a subnet

References: https://docs.microsoft.com/en-us/microsoft-365/solutions/cloud-architecture-models?view=o365-worldwide https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-static-private-ip-arm-pportal

Correct Answer:

Explanation:

Box 1: -ResourceGroupName

Deploy new resources to RG1.

The New-AzResourceGroupDeployment cmdlet adds a deployment to an existing resource group. This includes the resources that the deployment requires.

-ResourceGroupName

Specifies the name of the resource group to deploy.

Box 2: Complete

Remove all the existing resources from RG1 before deploying the new resources.

-Mode

Specifies the deployment mode. The acceptable values for this parameter are:

*

Complete: In complete mode, Resource Manager deletes resources that exist in the resource group but are not specified in the template.

*

Incremental: In incremental mode, Resource Manager leaves unchanged resources that exist in the resource group but are not specified in the template. Incorrect:

*

All

No mode named all.

Reference: https://learn.microsoft.com/en-us/powershell/module/az.resources/new-azresourcegroupdeployment

Correct Answer:

Once the VNets are peered, all resources on one VNet can communicate with resources on the other peered VNets. You plan to enable peering between Paris-VNet and AllOffices-VNet. Therefore VMs on Subnet1, which is on Paris-VNet and VMs on Subnet3, which is on AllOffices-VNet will be able to connect to each other.

All Azure resources connected to a VNet have outbound connectivity to the Internet by default. Therefore VMs on ClientSubnet, which is on ClientResources-VNet will have access to the Internet; and VMs on Subnet3 and Subnet4, which are on AllOffices-VNet will have access to the Internet.

Correct Answer: D

To deploy the container image to the Azure Kubernetes Service (AKS) cluster, you need to perform the following steps:

Run the docker push command: This option is the correct choice. Before deploying a container image to AKS, you need to push the image to a container registry (in this case, Registry1). The docker push command is used to upload the

container image to the Azure Container Registry (ACR) so that it can be accessed by the AKS cluster.

The correct sequence of steps would be:

Build the container image for App1 on your administrative workstation.

Tag the image with the ACR repository information (e.g., Registry1.azurecr.io/App1).

Run docker push to upload the image to ACR.

Configure AKS to use the image from the ACR repository.

Create Kubernetes deployment and service definitions for App1 on AKS.

Correct Answer: D

With Azure CNI, every pod gets an IP address from the subnet and can be accessed directly. These IP addresses must be unique across your network space. https://docs.microsoft.com/en-us/azure/aks/concepts-network#azure-virtual-networks

Correct Answer: AC

Correct Answer: A

Note: Rules are processed in priority order, with lower numbers processed before higher numbers, because lower numbers have higher priority. Once traffic matches a rule, processing stops. As a result, any rules that exist with lower

priorities (higher numbers) that have the same attributes as rules with higher priorities are not processed.

References:

https://docs.microsoft.com/en-us/azure/virtual-network/security-overview

Correct Answer: A

In order to read secrets from a key vault, you need to have a vault created and give your app permission to access it.

Create a key vault by following the Key Vault quickstart.

Create a managed identity for your application.

Key vault references use the app's system-assigned identity by default, but you can specify a user-assigned identity.

Authorize read access to secrets your key vault for the managed identity you created earlier. How you do it depends on the permissions model of your key vault:

Azure role-based access control: Assign the Key Vault Secrets User role to the managed identity. For instructions, see Provide access to Key Vault keys, certificates, and secrets with an Azure role-based access control. Vault access policy:

Assign the Get secrets permission to the managed identity. For instructions, see Assign a Key Vault access policy.

https://learn.microsoft.com/en-us/azure/app-service/app-service-key-vault-references?tabs=azure-cli