Every Azure AD directory comes with an initial domain name in the form of domainname.onmicrosoft.com. The initial domain name cannot be changed or deleted, but you can add your corporate domain name to Azure AD as well. For example, your organization probably has other domain names used to do business and users who sign in using your corporate domain name. Adding custom domain names to Azure AD allows you to assign user names in the directory that are familiar to your users, such as ‘alice@contoso.com.’ instead of ' alice@domain name.onmicrosoft.com ' .

Scenario:

Network Infrastructure: Each office has a local data center that contains all the servers for that office. Each office has a dedicated connection to the Internet.

Humongous Insurance has a single-domain Active Directory forest named humongousinsurance.com

Planned Azure AD Infrastructure: The on-premises Active Directory domain will be synchronized to Azure AD.

To meet the technical requirement that User1 can create initiative definitions and User4 can assign initiatives to RG2, we must understand how Azure Policy roles operate according to Microsoft Azure documentation and AZ-104 study guides.

Azure Policy uses role-based access control (RBAC) to determine who can create, manage, and assign policies or initiatives (policy sets). The key roles relevant to this task are:

Resource Policy Contributor – Allows users to create, edit, and delete policy definitions and initiative definitions, but does not allow assignment of policies or initiatives. This role is required for users who will design or build the policy logic (definitions).

Therefore, User1, who needs to create initiative definitions, must have the Resource Policy Contributor role.

Scope: Subscription (Sub1) – because initiatives are created at subscription or management group level.

Contributor – Provides full access to manage resources, except granting permissions. Contributors can assign existing policies or initiatives to resource groups or subscriptions if they have sufficient permissions.

Therefore, User4, who needs to assign initiatives to RG2, must be assigned the Contributor role at the RG2 scope.

Other roles:

Security Admin is related to Microsoft Defender for Cloud security settings, not policy creation.

Resource Policy Contributor for RG2 would not meet the requirement because creating definitions typically requires subscription-level access.

According to Microsoft Docs (“Azure built-in roles for Policy”):

“The Resource Policy Contributor role allows users to create, edit, and delete Azure policy and initiative definitions. To assign policies or initiatives, users need the Contributor or Owner role at the appropriate scope.”

Hence, the configuration should be:

User1: Resource Policy Contributor for Sub1

User4: Contributor for RG2

The question asks which storage account type should be created for storage5 and which existing storage account should be configured as the destination for replication — while supporting the planned changes.

Step 1: Planned Change Requirement

From the case study:

“Create a storage account named storage5 and configure storage replication for the Blob service.”

This indicates that storage5 will act as a secondary (destination) account to receive geo-replicated blobs (as part of RA-GRS or GRS replication configuration).

Therefore, the new storage5 must support Blob service replication features.

Step 2: Determining Correct Account Type

According to Microsoft Azure Administrator Documentation (Microsoft Learn: “Types of storage accounts”):

Account Type

Blob Support

File Share Support

Recommended Use

Storage (general purpose v1)

✅ Basic blob

Limited

Legacy use, lacks advanced features

StorageV2 (general purpose v2)

✅ Full blob, file, queue, table support

✅

Supports replication (GRS, RA-GRS, ZRS) and access tiers

BlobStorage

✅ Blob only

❌ No file shares

Used only for block and append blobs

BlockBlobStorage

✅ Blob only (premium tier)

❌ No file shares

High-performance workloads only

Therefore, the correct type for storage5 must be StorageV2, as it supports both:

Blob service replication (GRS, RA-GRS, ZRS, LRS)

All tiers (Hot, Cool, Archive)

This meets the planned change and ensures the account supports replication for Blob service.

Step 3: Determining the Correct Destination Storage Account

The question also requires identifying which existing storage account should act as the destination for replication configuration.

In Azure, Blob service replication (for example, geo-redundant replication or object replication) requires:

Both storage accounts to be StorageV2.

Both to be in the same region pair and have object replication enabled.

Looking at the table:

Storage Account

Kind

Location

File Share

Identity-based Access

storage1

Storage (general purpose v1)

West US

sharea

Azure AD DS

storage2

StorageV2 (general purpose v2)

East US

shareb, sharec

Disabled

storage3

BlobStorage

East US 2

N/A

N/A

storage4

FileStorage

Central US

shared

Azure AD DS

Only storage2 meets all of the following conditions:

✅ Type: StorageV2

✅ Region: East US (a valid replication pair for East US 2 or secondary region)

✅ Blob Service supported

Hence, storage2 is the correct destination storage account to configure for replication from storage5.

Step 4: Supporting Microsoft Azure Documentation Extracts

From Microsoft Learn – Azure Storage account overview:

“General-purpose v2 accounts support all Azure Storage features, including blob, file, queue, and table storage. They are recommended for most scenarios.”

“Object replication requires both source and destination accounts to be of the same type (StorageV2) and in regions that are geo-paired.”

“Blob and StorageV2 accounts support replication options such as LRS, ZRS, GRS, and RA-GRS.”

Statement 1: Yes

Contoso is moving the existing product blueprint files to Azure Blob storage which will ensure that the blueprint files are stored in the archive storage tier.

Use unmanaged standard storage for the hard disks of the virtual machines. We use Page Blobs for these.

Statement 2: No

Azure Table storage stores large amounts of structured data. The service is a NoSQL datastore which accepts authenticated calls from inside and outside the Azure cloud. Azure tables are ideal for storing structured, non-relational data. Common uses of Table storage include:

1. Storing TBs of structured data capable of serving web scale applications

2. Storing datasets that don ' t require complex joins, foreign keys, or stored procedures and can be denormalized for fast access

3. Quickly querying data using a clustered index

4. Accessing data using the OData protocol and LINQ queries with WCF Data Service .NET Libraries

Statement 3: No

File Storage can be used if your business use case needs to deal mostly with standard File extensions like *.docx, *.png and *.bak then you should probably go with this storage option.

1️⃣ Create a Log Analytics workspace.

2️⃣ Collect Windows performance counters from the Log Analytics agents.

3️⃣ Create an alert rule.

The question states:

“You need to configure the alerts for VM1 and VM2 to meet the technical requirements.”

The technical requirement from the case study specifies:

“Trigger an alert if VM1 or VM2 has less than 20 GB of free space on volume C.”

This requirement involves monitoring performance metrics (disk space) and generating alerts based on those metrics. According to Microsoft Azure monitoring and management documentation, the process to configure such alerts involves using Azure Monitor and Log Analytics.

Step-by-Step Verified Solution:

Step 1: Create a Log Analytics workspace

A Log Analytics workspace is required to store and analyze logs and performance data collected from virtual machines.

Azure Monitor uses this workspace as the central repository for performance counters, events, and logs from connected agents.

From the Microsoft Documentation:

“Before you can collect and query data from virtual machines, you must create a Log Analytics workspace in your subscription.”

(Source: Azure Monitor and Log Analytics Guide)

Step 2: Collect Windows performance counters from the Log Analytics agents

After creating the workspace, you must connect VM1 and VM2 to the workspace and configure the Windows performance counters that you want to monitor.

In this case, you would collect the LogicalDisk(%) Free Space counter for C: drive.

Azure Monitor agent or Log Analytics agent collects these metrics and sends them to the workspace for analysis.

“To monitor system performance, configure the agent to collect performance counters such as available memory or free disk space.”

(Source: Azure Monitor Performance Counters Documentation)

Step 3: Create an alert rule

Once performance data is being collected, you can create an alert rule in Azure Monitor based on a Kusto query or metric threshold.

You would define a condition such as:

LogicalDisk | where FreeSpaceMB < 20480

and configure it to trigger an alert when free space on volume C drops below 20 GB.

This alert can notify via email, action group, or automation runbook.

“Alerts in Azure Monitor proactively notify you when important conditions are found in your monitoring data. Alerts can trigger automated actions or notifications.”

(Source: Azure Monitor Alerts Overview)

Incorrect Options (Eliminated):

Configure the Diagnostic settings:

Used for collecting activity logs or resource logs, not performance counters from VMs.

Create an Azure SQL database:

Not relevant to the scenario of monitoring disk space.

✅ Yes, Yes, No

 Stored access policies: ✅ 2

 Immutable blob storage policies: ✅ 1

From the scenario in the earlier case study (A. Datum Corporation):

The planned change requires creating a new container named cont2 in storage1, with the following:

Three stored access policies (Stored1, Stored2, Stored3)

A legal hold for immutable blob storage

Also, recall from the table:

storage1 has Hierarchical namespace = Yes (Data Lake Storage Gen2 enabled).

storage2 has Hierarchical namespace = No.

The question asks: “What is the maximum number of additional access policies you can create for cont2?”

According to Microsoft Azure Storage documentation:

A blob container can have a maximum of five stored access policies.

These policies allow shared access signatures (SAS) to be managed centrally, letting you define start times, expiry times, and permissions at the container level.

Since three stored access policies (Stored1, Stored2, Stored3) already exist, the maximum additional policies that can still be created is:

→ 5 (maximum allowed) – 3 (already existing) = 2

For immutable blob storage policies:

A container can have one active immutability policy at a time.

This can be either a time-based retention policy or a legal hold policy.

Since cont2 already has a legal hold applied, no additional immutable policy can coexist with it, but it can have one defined policy type (the legal hold).

Therefore:

Stored access policies: 2 additional policies can still be created.

Immutable blob storage policies: 1 policy (the existing legal hold).

This aligns exactly with Microsoft Learn: Azure Storage Blob Service limits and immutable storage documentation:

“A container may have up to five stored access policies. Immutable storage supports either a time-based retention policy or legal hold policy per container.”

Final Verified Answer:

✅ Stored access policies: 2

✅ Immutable blob storage policies: 1

According to the Microsoft Azure Administrator (AZ-104) Study Guide and Azure Role-Based Access Control (RBAC) documentation, permissions to link an Azure Private DNS zone to a virtual network require access to both the virtual network resource and the DNS zone resource.

The process of linking a DNS zone to a virtual network establishes name resolution for the resources within that VNet through the Private DNS zone. To perform this operation, the user must have:

“Microsoft.Network/virtualNetworks/*” permissions (to modify and manage VNet settings).

“Microsoft.Network/privateDnsZones/*” permissions (to manage DNS zone links).

These permissions are granted by two built-in roles:

Network Contributor – Allows full management of the network resources like virtual networks, subnets, and network interfaces but does not allow access to manage DNS zones.

Private DNS Zone Contributor – Allows management of private DNS zones and their link configurations.

Therefore, to grant User1 the ability to link Zone1.com (Private DNS Zone) to VNet1, the correct approach is to assign both roles with the least privilege principle, scoped specifically to the required resources:

Network Contributor on VNet1

Private DNS Zone Contributor on zone1.com

Assigning the permissions at the resource level (and not at the resource group or subscription level) ensures compliance with the principle of least privilege, a core requirement of Azure governance.

This setup enables User1 to perform the exact operation (linking the Private DNS Zone to the VNet) while preventing unnecessary access to unrelated resources.

Final Verified Answer:

✅ Roles: Network Contributor and Private DNS Zone Contributor only

✅ Resources: VNet1 and zone1.com only

In Microsoft Azure, containerized application deployment can occur using multiple services, depending on the image type and operating system platform used. The question refers to two images — Image1 (Windows Server) and Image2 (Linux) — which are stored in an Azure Container Registry (ACR).

According to the Microsoft Azure Administrator Study Guide (AZ-104) and official Azure documentation, both Windows-based and Linux-based container images can be deployed using any of the following services, depending on the workload requirements:

Azure App Service (Web App for Containers) – supports both Windows and Linux containers for web applications. It allows developers to directly deploy containerized applications from Docker Hub, Azure Container Registry, or a private registry.

Azure Container Apps – serverless container hosting designed for microservices and event-driven architectures. It supports Linux and Windows containers, using Kubernetes behind the scenes, without requiring users to manage the cluster infrastructure.

Azure Container Instances (ACI) – provides lightweight, serverless containers for quick deployment and isolated workloads. It supports both Windows and Linux images and can pull directly from Azure Container Registry.

Therefore, since both Image1 (Windows Server) and Image2 (Linux) are valid container images supported by the same three Azure container services, the correct and verified solution is to select “App Service, Azure Container Apps, or Azure Container Instances” for both.

This matches Azure documentation under:

“Run containerized applications in Azure App Service”

“Deploy containers using Azure Container Instances”

“Build and deploy microservices using Azure Container Apps”

Each of these Azure services supports containerized deployments from ACR regardless of the underlying operating system image type.

Final Verified Answer:

✅ Image1: App Service, Azure Container Apps, or Azure Container Instances

✅ Image2: App Service, Azure Container Apps, or Azure Container Instances

Statement 1: Yes

All client computers in the Paris office will be joined to an Azure AD domain.

A virtual network named Paris-VNet that will contain two subnets named Subnet1 and Subnet2.

Microsoft Windows Server Active Directory domains, can resolve DNS names between virtual networks. Automatic registration of virtual machines from a virtual network that ' s linked to a private zone with auto-registration enabled. Forward DNS resolution is supported across virtual networks that are linked to the private zone.

Statement 2: Yes

A virtual network named ClientResources-VNet that will contain one subnet named ClientSubnet You plan to create a private DNS zone named humongousinsurance.local and set the registration network to the ClientResources-VNet virtual network.

As this is a registration network so this will work.

Statement 3: No

Only VMs in the registration network, here the ClientResources-VNet, will be able to register hostname records. Since Subnet4 not connected to Client Resources Network thus not able to register its hostname with humongoinsurance.local

Once the VNets are peered, all resources on one VNet can communicate with resources on the other peered VNets. You plan to enable peering between Paris-VNet and AllOffices-VNet. Therefore VMs on Subnet1, which is on Paris-VNet and VMs on Subnet3, which is on AllOffices-VNet will be able to connect to each other.

All Azure resources connected to a VNet have outbound connectivity to the Internet by default. Therefore VMs on ClientSubnet, which is on ClientResources-VNet will have access to the Internet; and VMs on Subnet3 and Subnet4, which are on AllOffices-VNet will have access to the Internet.

Explanation

Scenario:

1. Web administrators will deploy Azure web apps for the marketing department.

2. Each web app will be added to a separate resource group.

3. The initial configuration of the web apps will be identical.

4. The web administrators have permission to deploy web apps to resource groups.

Steps:

1 -- > Create a resource group, and then deploy a web app to the resource group.

2 -- > From the Automation script blade of the resource group , click Add to Library.

3 -- > From the Templates service, select the template, and then share the template to the web administrators .

B: You can gradually roll out Seamless SSO to your users. You start by adding the following Azure AD URL to all or selected users ' Intranet zone settings by using Group Policy in Active Directory: https://autologon.microsoftazuread-sso.com

E: Seamless SSO works with any method of cloud authentication - Password Hash Synchronization or Pass-through Authentication, and can be enabled via Azure AD Connect.

Box 1: Create a virtual network gateway and a local network gateway.

Azure VPN gateway. The VPN gateway service enables you to connect the VNet to the on-premises network through a VPN appliance. For more information, see Connect an on-premises network to a Microsoft Azure virtual network. The VPN gateway includes the following elements:

Virtual network gateway. A resource that provides a virtual VPN appliance for the VNet. It is responsible for routing traffic from the on-premises network to the VNet.

Local network gateway. An abstraction of the on-premises VPN appliance. Network traffic from the cloud application to the on-premises network is routed through this gateway.

Connection. The connection has properties that specify the connection type (IPSec) and the key shared with the on-premises VPN appliance to encrypt traffic.

Gateway subnet. The virtual network gateway is held in its own subnet, which is subject to various requirements, described in the Recommendations section below.

Box 2: Configure a site-to-site VPN connection

On premises create a site-to-site connection for the virtual network gateway and the local network gateway.

Scenario: Connect the New York office to VNet1 over the Internet by using an encrypted connection.

https://docs.microsoft.com/en-us/azure/role-based-access-control/tutorial-custom-role-powershell

Get-AzRoleDefinition -Name " Reader " | ConvertTo-Json

https://docs.microsoft.com/en-us/powershell/module/az.resources/get-azroledefinition?view=azps-5.9.0

https://docs.microsoft.com/en-us/azure/role-based-access-control/tutorial-custom-role-powershell

https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/convertto-json?view=powershell-7.1

https://docs.microsoft.com/en-us/powershell/module/azuread/get-azureaddirectoryrole?view=azureadps-2.0

Box 1: Create a Recovery Services vault

Create a Recovery Services vault on the Azure Portal.

Box 2: Install the Azure Site Recovery Provider

Azure Site Recovery can be used to manage migration of on-premises machines to Azure.

Scenario: Migrate the virtual machines hosted on Server1 and Server2 to Azure.

Server2 has the Hyper-V host role.

No

Yes

No

Azure Bastion is a fully managed platform-as-a-service (PaaS) solution that allows secure RDP (for Windows VMs) and SSH (for Linux VMs) connections directly through the Azure portal — without exposing public IP addresses. It provides browser-based connectivity over TLS from the Azure portal and uses port 443 only.

Let’s analyze the scenario step by step based on the provided configuration and the Microsoft Azure Administrator documentation (AZ-104 study guide):

Network Topology Review

VNet

Location

Peered With

VNet1

East US

VNet2

VNet2

East US

VNet1, VNet3

VNet3

West US

VNet2

VM

OS

Connected To

VM1

Windows

VNet1

VM2

Linux

VNet2

VM3

Windows

VNet3

Bastion1 is deployed in VNet1, which is peered with VNet2 (but not directly with VNet3).

Statement Analysis

1. The Remote Desktop Connection client (mstsc.exe) can be used to connect to VM1 through Bastion1

Azure Bastion does not support native clients like mstsc.exe.

Bastion connections are made only via the Azure portal using web-based RDP or SSH.

The mstsc.exe client requires a direct RDP connection, which is not provided through Azure Bastion.

✅ Answer: No

2. The Azure portal can use SSH to connect to VM2 through Bastion1

Bastion1 is deployed in VNet1, which is peered with VNet2.

Azure Bastion supports connections to peered VNets within the same region, as long as network peering allows traffic between VNets and the VM does not require a public IP.

VM2 (Linux) is connected to VNet2, which is peered with VNet1 (same region, East US).

Therefore, the Azure portal can use SSH (port 22) through Bastion1 to connect to VM2.

✅ Answer: Yes

3. The Azure portal can be used to connect to VM3 through Bastion1

VM3 is connected to VNet3, which is in West US.

Bastion1 (in VNet1, East US) cannot connect across regions, even though VNet2 is peered with both VNet1 and VNet3.

Bastion does not support transitive peering — meaning Bastion1 cannot connect to VMs in VNets indirectly connected (VNet3 in this case).

✅ Answer: No

Key Azure Documentation Points (Microsoft Learn Extract):

“Azure Bastion allows you to securely connect to a VM in the same virtual network or a peered virtual network in the same region.”

“Bastion does not support transitive peering or connections across regions.”

“Connections are made through the Azure portal only and not via native RDP or SSH clients.”

(Source: Microsoft Learn — Azure Bastion Overview and Connectivity Requirements)

In Microsoft Azure, connectivity between virtual networks depends on IP address space, region, and subscription constraints.

1️⃣ Site-to-Site VPN between VNET1 and VNET2 – YES:

Azure supports a Site-to-Site VPN connection between two VNets in different regions or subscriptions as long as both have non-overlapping address spaces and contain a VPN gateway. In this case, VNET1 (10.10.10.0/24 – West Europe) and VNET2 (172.16.0.0/16 – West US) have unique address spaces, so a S2S connection is possible.

2️⃣ VNET1 and VNET2 Peering – YES:

VNet peering enables direct communication over the Microsoft backbone network with low latency and no gateway requirement. Global VNet Peering supports VNets in different Azure regions (e.g., West Europe and West US) as long as address spaces do not overlap—which is true here.

3️⃣ VNET1 and VNETA Peering – NO:

VNETA’s address space (10.10.128.0/17) overlaps with VNET1 (10.10.10.0/24), because both belong to the same 10.10.0.0/8 range. Azure explicitly blocks VNet peering between VNets with overlapping address spaces to avoid routing conflicts.

According to Microsoft Learn (“Virtual network peering – requirements and constraints”), peering is only supported when address spaces do not overlap. Therefore, VNET1 and VNETA cannot be peered.

In this case, you have two alert rules: Alert1 and Alert2. Alert1 has a scope of RG1, which means it applies to all the resources in the resource group named RG1. Alert1 has a condition of All Administrative operations, which means it triggers when any administrative operation is performed on the resources in RG1. An administrative operation is any operation that changes the configuration or state of a resource, such as creating, deleting, updating, or restarting.

Alert2 has a scope of VM1, which means it applies only to the virtual machine named VM1. Alert2 also has a condition of All Administrative operations, which means it triggers when any administrative operation is performed on VM1.

Now, let’s see which alert rules are triggered by each user.

User1 creates a new virtual disk and attaches the disk to VM1. This is an administrative operation on VM1, so it triggers Alert2. However, it does not trigger Alert1, because the new disk is not part of RG1. Therefore, the correct answer for User1 is C. Only Alert2 is triggered.

User2 creates a new resource tag and assigns the tag to RG1 and VM1. This is also an administrative operation on both RG1 and VM1, so it triggers both Alert1 and Alert2. Therefore, the correct answer for User2 is D. Alert1 and Alert2 are triggered.