Scenario: Litware must meet technical requirements including:

Ensure that VM3 can establish outbound connections over TCP port 8080 to the applications servers in the Montreal office.

IP flow verify checks if a packet is allowed or denied to or from a virtual machine. The information consists of direction, protocol, local IP, remote IP, local port, and remote port. If the packet is denied by a security group, the name of the rule that denied the packet is returned. While any source or destination IP can be chosen, IP flow verify helps administrators quickly diagnose connectivity issues from or to the internet and from or to the on-premises environment.

Box 1: Create a Recovery Services vault

Create a Recovery Services vault on the Azure Portal.

Box 2: Install the Azure Site Recovery Provider

Azure Site Recovery can be used to manage migration of on-premises machines to Azure.

Scenario: Migrate the virtual machines hosted on Server1 and Server2 to Azure.

Server2 has the Hyper-V host role.

Box 1: Create a virtual network gateway and a local network gateway.

Azure VPN gateway. The VPN gateway service enables you to connect the VNet to the on-premises network through a VPN appliance. For more information, see Connect an on-premises network to a Microsoft Azure virtual network. The VPN gateway includes the following elements:

Virtual network gateway. A resource that provides a virtual VPN appliance for the VNet. It is responsible for routing traffic from the on-premises network to the VNet.

Local network gateway. An abstraction of the on-premises VPN appliance. Network traffic from the cloud application to the on-premises network is routed through this gateway.

Connection. The connection has properties that specify the connection type (IPSec) and the key shared with the on-premises VPN appliance to encrypt traffic.

Gateway subnet. The virtual network gateway is held in its own subnet, which is subject to various requirements, described in the Recommendations section below.

Box 2: Configure a site-to-site VPN connection

On premises create a site-to-site connection for the virtual network gateway and the local network gateway.

Scenario: Connect the New York office to VNet1 over the Internet by using an encrypted connection.

Technically, The finance department needs to migrate their users from AD to AAD using AADC based on the finance OU, and need to enforce MFA use. This is conditional access policy. Employees also often get promotions and/or join other departments and when that occurs, the user ' s OU attribute will change when the admin puts the user in a new OU, and the dynamic group conditional access exception (OU= [Department Name Value]) will move the user to the appropriate dynamic group on next AADC delta sync.

https://docs.microsoft.com/en-us/azure/active-directory/enterprise-users/groups-dynamic-membership

https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/overview

https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-userstates

When collecting Windows Event Logs using the Azure Monitor Agent (AMA) with a Data Collection Rule (DCR), filtering is done at the source using XPath queries. XPath is specifically designed for querying XML-based event log entries, including filtering by Event ID, Event Level, and Event Source.

According to Azure Monitor documentation, Windows Event Log data sources require XPath expressions, not SQL or KQL. KQL is used after ingestion for querying data in Log Analytics, while XPath determines which events are collected in the first place.

Since the requirement is to collect only system events with Event ID 1001, the correct query type for the DCR data source is XPath.

Final Answer: C. XPath

To meet the specified requirements for creating an Azure Storage account that supports Azure Data Lake Storage, minimizes costs, and automatically replicates to a secondary region, the following settings are appropriate:

1️⃣ Support Azure Data Lake Storage → Enable Hierarchical Namespace

Azure Data Lake Storage Gen2 requires the Hierarchical Namespace feature to be enabled in the storage account. This allows directory-based organization and fine-grained access control for big data analytics.

✅ Answer: C. hierarchical namespace

2️⃣ Minimize costs for infrequently accessed data → Cool Access Tier

Azure Storage provides Hot, Cool, and Archive access tiers.

Hot = optimized for frequent access.

Cool = optimized for infrequent access (lower storage cost, higher access cost).

Archive = for offline, rarely accessed data.

For data that is infrequently accessed but still available online, Cool tier minimizes cost while maintaining accessibility.

✅ Answer: A. Cool access tier

3️⃣ Automatically replicate data to a secondary region → Geo-Redundant Storage (GRS)

Replication options include:

LRS (Locally Redundant Storage) – single-region redundancy.

ZRS (Zone Redundant Storage) – replication within one region.

GRS (Geo-Redundant Storage) – replicates data to a secondary Azure region automatically.

RA-GRS (Read-Access GRS) – allows read access to the secondary region.

For automatic replication to a secondary region, GRS is required.

✅ Answer: E. geo-redundant storage (GRS)

Microsoft Documentation Extract Summary:

“Azure Data Lake Storage Gen2 is built on Azure Blob storage and requires the Hierarchical namespace setting to be enabled.”

“The Cool access tier is designed for infrequently accessed data, offering reduced storage costs.”

“Geo-redundant storage (GRS) replicates data to a secondary region for durability and disaster recovery.”

(Source: Microsoft Learn – Create and configure Azure Storage accounts)

According to the Microsoft documentation, a shared access signature (SAS) is a URI that grants restricted access rights to Azure Storage resources. You can provide a SAS to clients who don’t otherwise have access to your storage account, and delegate access to them for a specified time period and with a specified set of permissions.

A SAS can be used to grant read-only access to a container and its blobs, as well as specify the allowed protocols (HTTP or HTTPS) and the start and expiry time of the access. For more information about creating and using SAS, see Using shared access signatures (SAS).

An access policy is not the correct answer because it is used to define a set of permissions and a time period for a container or a queue, but it does not grant access by itself. An access policy must be associated with a SAS to take effect. For more information about access policies, see Manage stored access policies for containers and queues.

Azure Content Delivery Network (CDN) is not the correct answer because it is used to cache and deliver content from Azure Storage or other sources, but it does not control the access permissions to the content. For more information about Azure CDN, see [What is Azure Content Delivery Network?] .

Access keys are not the correct answer because they are used to authenticate requests to Azure Storage from any client, but they do not limit the access permissions or the protocols. Using access keys also exposes your storage account to potential unauthorized access if the keys are compromised. For more information about access keys, see [Manage storage account access keys].

Box 1: N

Because doesn ' t have:

Microsoft.Authorization/*/Write - Create roles, role assignments, policy assignments, policy definitions and policy set definitions

Box 2; Yes

Has been assigned;

Microsoft.Compute/virtualMachines/* - Perform all virtual machine actions including create, update, delete, start, restart, and power off virtual machines. Execute scripts on virtual machines.

Box 3: Y

Has been assigned;

Microsoft.Network/networkInterfaces/* - Create and manage network interfaces

See;

https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

When Microsoft schedules maintenance for an Azure virtual machine (VM), the affected VM may experience a short downtime or host migration. In some cases, administrators can proactively move the VM to a new physical host before maintenance begins to minimize disruption.

According to the Microsoft Azure Administrator documentation, the only supported method to proactively move a VM to a new host is to use the Redeploy feature available under VM → Redeploy + reapply in the Azure portal or through PowerShell (Set-AzVM -Redeploy).

The Redeploy operation stops the VM, moves it to a new physical host within the same region, and then restarts it automatically. This ensures the VM is placed on healthy hardware immediately, mitigating any pending maintenance impact.

In contrast, moving a VM to a different subscription:

Is a metadata-level operation, not a host-level migration.

Requires the VM to be in a deallocated state before the move.

Does not cause the VM to change its underlying physical host.

Is typically used for billing or management reorganization, not to mitigate maintenance events.

Therefore, moving the VM to another subscription does not achieve the goal of moving VM1 to a different physical host. The VM remains on the same compute node until redeployed or maintenance is automatically performed by Azure.

The correct solution in this scenario is to use “Redeploy” from the VM blade, which explicitly triggers host relocation.