In Azure Active Directory (Microsoft Entra ID), dynamic group membership rules allow administrators to automatically include or exclude users based on specific user attributes (such as department, country, job title, etc.). These rules use the Azure AD dynamic membership rule syntax, which is a logical query language similar to PowerShell filtering.

Scenario Requirements

You need to:

Create a Microsoft 365 group (Office 365 group).

Automatically include users who meet both of the following conditions:

The user’s department is Marketing.

The user’s country is France.

This requires a compound logical condition using the and operator to ensure both criteria are true.

1. Attribute Names

According to Microsoft Azure AD dynamic membership documentation, the supported attributes for user membership rules include:

user.department → represents the department assigned to the user profile.

user.country → represents the country or region defined for the user.

Both attributes are supported and commonly used in group dynamic membership rules.

2. Operators

The operator -eq is used for equality comparison in dynamic rules.

Microsoft documentation states:

“Use the -eq operator to test equality. The operator is case-insensitive and compares attribute values to string literals.”

For logical combinations, and joins multiple expressions together so that all conditions must be true for membership.

3. Syntax Construction

To meet both conditions:

(user.department -eq " Marketing " ) and (user.country -eq " France " )

user.department -eq " Marketing " → Selects all users in the Marketing department.

and → Ensures the next condition must also be true.

user.country -eq " France " → Filters those users located in France.

This rule will dynamically add users who belong to the Marketing department and are located in France to the group.

4. Microsoft Official Source Extract

From Microsoft Learn (“Rules for dynamically populated groups in Azure Active Directory”):

“You can build complex rules with multiple expressions joined by -and, -or, and -not operators. For example:

(user.department -eq " Sales " ) and (user.country -eq " US " )”

This is directly analogous to the required rule for Marketing users in France.

✅ Final Verified Answer:

Dynamic membership rule:

(user.department -eq " Marketing " ) and (user.country -eq " France " )

Summary:

Attribute 1: user.department

Operator 1: -eq

Logical Operator: and

Attribute 2: user.country

Operator 2: -eq

Value: " France "

Hence, the dynamic rule correctly and efficiently includes only Marketing users located in France, as per Azure AD Administrator documentation and Microsoft’s official membership rule syntax.

The minimum number of available virtual machines during planned datacenter maintenance is 12 . In an Azure availability set, update domains are used for planned maintenance events. Microsoft states that only one update domain is restarted at a time during planned maintenance, and the restarted update domain has time to recover before maintenance proceeds to another update domain.

AS1 has 5 update domains and contains 16 virtual machines . Azure distributes VMs across update domains as evenly as possible. With 16 VMs across 5 update domains, the largest update domain can contain 4 VMs because 16 ÷ 5 results in a distribution such as 4, 3, 3, 3, and 3. During planned maintenance, the update domain with the highest number of VMs could be unavailable. Therefore, the minimum available VMs are:

16 total VMs - 4 VMs in one update domain = 12 available VMs

Fault domains protect against unplanned hardware failures, such as rack or power failures, and do not determine the number of VMs unavailable during planned maintenance. This aligns with AZ-104 Deploy and manage Azure compute resources , specifically VM availability sets, update domains, and fault domains.

This question relates to deploying an Azure Container Instance (ACI) using a container image stored in an Azure Container Registry (ACR) named Registry1. The error that occurs when deploying typically indicates authentication or network access issues between ACI and ACR.

Let’s break down the scenario and solution step by step using Microsoft Learn and AZ-104 Administrator Study Guide principles.

Key Concept: How ACI Pulls Images from ACR

When you deploy a container instance that uses an image stored in an Azure Container Registry, ACI must authenticate with the registry to pull the image.

By default, ACR is private — meaning unauthenticated users (or services) cannot pull images.

Azure provides several ways to allow this communication:

Grant access using an Azure managed identity (recommended).

Enable the Admin user and provide credentials in the deployment configuration.

Assign a service principal with the AcrPull role.

Enable public network access for the registry (less secure).

What a Private Endpoint Does

Creating a private endpoint for the registry allows access to the ACR over a private IP address from within a virtual network.

According to Microsoft Learn:

“Private endpoints for Azure Container Registry enable secure access to the registry over a private link, but they do not automatically configure permissions or authentication for pulling images.”

While the private endpoint provides network connectivity, it does not handle authentication or permissions. Therefore, even with a private endpoint, ACI would still fail to pull the image unless it has appropriate role assignments or credentials to access ACR.

Why the Solution Does Not Meet the Goal

The error mentioned in the question (deployment failure) typically happens because ACI cannot authenticate to ACR.

Creating a private endpoint only provides private network connectivity, not authentication.

The correct solution would involve one of the following:

Assigning the AcrPull role to the ACI’s managed identity for the ACR scope.

Enabling Admin user access on ACR and providing credentials.

Hence, simply creating a private endpoint does not resolve the deployment failure.

A Shared Access Signature (SAS) defines how, when, and from where a storage resource can be accessed. The exhibit shows the following important configuration details for SAS1:

Validity period: January 1, 2025 through January 1, 2028 → both access attempts occur within the valid timeframe.

Allowed IP addresses: Not specified → access is allowed from any IP address.

Allowed protocols: HTTPS only

Signing key: key1

Scenario 1 – Azure Storage Explorer

Azure Storage Explorer accesses Azure Storage using the HTTPS REST API. Because:

The access is within the SAS validity period,

No IP restriction is configured,

HTTPS is allowed,

the connection succeeds. However, the SAS configuration shown does not include write or list permissions, meaning access is limited to read-only operations.

✔ Result: Will have read-only access

Scenario 2 – net use to connect to Azure file share

The net use command connects to Azure Files using SMB (port 445). SMB traffic does not use HTTPS.

Because the SAS explicitly restricts access to HTTPS only, SMB-based access is blocked, regardless of IP address or validity period.

Microsoft Azure documentation clearly states:

“When HTTPS only is selected, requests that use HTTP or SMB are denied.”

✔ Result: Will have no access

Final Answer Summary

Scenario

Result

Storage Explorer over HTTPS

Will have read-only access

SMB (net use) connection

Will have no access

✅ Final Verified Answer:

First scenario: Will have read-only access

Second scenario: Will have no access

In a hybrid Azure Active Directory (Azure AD) environment, where user identities can be cloud-only or synchronized from on-premises Active Directory (AD), attribute management depends on the source of authority for each user account.

The source of authority determines where you can modify a user’s attributes:

If a user is synced from on-premises Active Directory (on-premises sync enabled = Yes), certain attributes are read-only in Azure AD and must be edited in the on-premises AD. These attributes include:

Job title

Department

Office

Manager

Company name

If a user is cloud-only (not synchronized) or a guest user, you can modify those same attributes directly in Azure AD via the Azure portal, Microsoft Graph, or PowerShell.

According to Microsoft Learn (Azure AD attributes and synchronization rules):

“When Azure AD Connect synchronizes identities, certain user attributes such as job title, department, and manager are mastered in on-premises Active Directory and become read-only in Azure AD. However, attributes like usage location can always be edited in Azure AD, as they are required for license assignment.”

Applying to this question

User

Type

On-premises sync enabled

Editable in Azure AD

User1

Member

No

Editable (Cloud-only)

User2

Member

Yes

On-premises sync (Read-only for JobTitle)

User3

Guest

No

Editable in Azure AD

JobTitle

User1 – Editable (cloud-only member)

User2 – Not editable (synced from on-prem AD)

User3 – Editable (guest accounts managed in Azure AD)

✅ Answer: User1 and User3 only

UsageLocation

This attribute must be set in Azure AD for licensing and service access.

It can be edited for all users — even for synced users or guests — because Azure AD maintains it as a cloud-only attribute, not synchronized from on-prem AD.

✅ Answer: User1, User2, and User3

Final Verified Answers (Based on Microsoft Azure Administrator Documentation):

Attribute

Editable Users

JobTitle

✅ User1 and User3 only

UsageLocation

✅ User1, User2, and User3

Microsoft Official Documentation Extract:

“Attributes such as job title, department, and office location are sourced from on-premises AD and cannot be modified in Azure AD for synchronized users. The usage location attribute, however, is always managed in Azure AD.”

(Source: Microsoft Learn – Azure AD Connect sync: Attributes synchronized to Azure AD and Manage user profile attributes in Azure AD)

In Microsoft Azure Active Directory (Azure AD), there is a clear distinction between internal users (members) and external users (guests). When you need to add a large number of external users (B2B collaborators) — such as those listed in a CSV file — you must use Azure AD B2B invitation processes, not the Bulk create user operation.

According to the Microsoft Azure Administrator Study Guide and Azure AD documentation, the Bulk create user operation in the Azure portal is designed only for internal user accounts within the organization’s directory. It cannot be used to create guest user accounts. Guest users must be invited to the directory using either:

The New-AzureADMSInvitation PowerShell cmdlet, which sends invitations to external users’ email addresses and creates guest accounts (userType = “Guest”).

The Azure AD portal “Bulk invite” feature, which allows uploading a CSV file containing email addresses of external users to automate guest account creation.

The documentation explicitly states:

“To invite external users (B2B collaboration users) in bulk, you must use the Bulk invite feature or PowerShell with the New-AzureADMSInvitation cmdlet. The Bulk create operation is only supported for member users.”

(Source: Microsoft Learn – Azure Active Directory B2B collaboration and bulk operations guide)

Therefore, since the scenario uses Bulk create user, it does not meet the goal of creating guest accounts for external users.

The app must be running in the Standard, Premium, or Isolated tier in order for you to enable multiple deployment slots. If the app isn ' t already in the Standard, Premium, or Isolated tier, you receive a message that indicates the supported tiers for enabling staged publishing. At this point, you have the option to select Upgrade and go to the Scale tab of your app before continuing.

Scale up: Get more CPU, memory, disk space, and extra features like dedicated virtual machines (VMs), custom domains and certificates, staging slots, autoscaling, and more.

Scale out: Increase the number of VM instances that run your app. You can scale out to as many as 30 instances

In this scenario, the network security group (NSG) vm1441-nsg controls inbound traffic to VM1. Azure NSGs operate using priority-based rules, where the lower number indicates a higher priority. Rules are processed in ascending order until a match is found.

From the NSG configuration in the exhibit:

Rule2 (Priority 100): Deny traffic on ports 50–60.

Rule “RDP” (Priority 300): Allow TCP 3389 (RDP).

Rule1 (Priority 400): Allow ports 50–500.

Default rules (priority 65000–65500) permit traffic within the VNet and Azure Load Balancer, and deny all others.

Azure NSGs apply first-match logic — once a rule matches, no subsequent rules are processed. The lower-numbered Rule2 (priority 100) takes precedence over Rule1 (priority 400), meaning ports 50–60 are denied before Rule1 can allow them.

Given that:

The web server typically runs on port 80 (HTTP) or 443 (HTTPS), which are not affected by Rule2 — they remain allowed by default or open firewall configuration.

The DNS server uses UDP/TCP port 53, which falls within the denied range (50–60) under Rule2.

Therefore:

While Rule2 exists, Internet users can only access the web server (port 80/443).

Once Rule2 is deleted, the deny restriction for ports 50–60 is removed, meaning both the web server (80/443) and DNS server (53) are accessible.

This aligns directly with Microsoft Azure documentation for NSGs (Microsoft Learn: “Network security groups filter network traffic to and from Azure resources by using 5-tuple rules (source, destination, port, protocol, and direction). Rules are processed in priority order, and the first match wins.”).