To create an inbound NAT rule, you need to specify a frontend IP address and a frontend port for the load balancer to receive the traffic, and a backend IP address and a backend port for the load balancer to forward the traffic to1. According to the first table, LB1 has only one frontend IP address, which is 40.121.183.105. However, this frontend IP address is already used by the existing inbound NAT rule named rule1, which forwards port 80 to VM1 on port 802. Therefore, you cannot use the same frontend IP address and port for another inbound NAT rule.

To solve this problem, you need to create a new frontend IP address for LB1 before you can create the new inbound NAT rules. You can do this by using the Azure portal, PowerShell, or CLI3. After you create a new frontend IP address, you can use it to create the new inbound NAT rules that meet your requirements.

✅ VM3 – Yes

✅ VM4 – No

✅ VM5 – No

In Azure DNS, delegating a subdomain (such as research.adatum.com) to another DNS server or DNS zone requires creating a Name Server (NS) record in the parent domain (adatum.com).

Here’s how DNS delegation works according to the Microsoft Azure DNS documentation:

The parent DNS zone (adatum.com) must contain an NS record set for the subdomain (research).

This NS record points to the authoritative name servers of the child DNS zone (research.adatum.com).

When a DNS query is made for any record under research.adatum.com, the DNS resolution process will follow the delegation and forward the query to the specified DNS servers.

Example configuration:

Record Type

Name

Value

NS

research

ns1-xx.azure-dns.com

ns2-xx.azure-dns.net

This delegation ensures that the subdomain research.adatum.com is managed independently, possibly by another team or subscription.

Other options:

PTR record: Used for reverse DNS lookups, not for delegation.

SOA record: Defines start of authority for a zone, not delegation.

A record: Maps a name to an IP address, not for delegating zones.

✅ Final Verified Answer: B. Create an NS record named research in the adatum.com zone

This question focuses on how to monitor network connectivity and latency between Azure virtual machines and on-premises resources using Azure Network Watcher – Connection Monitor (v2).

???? Scenario Breakdown

VM1: Azure virtual machine (in your subscription)

DC1: On-premises domain controller (in your datacenter)

Connectivity: Via ExpressRoute

Goal: Use Connection Monitor to track network latency between VM1 (Azure) and DC1 (on-premises)

To achieve this, both endpoints (VM1 and DC1) must have agents capable of collecting and sending network telemetry data to Azure Monitor.

???? Understanding Azure Connection Monitor (v2)

According to Microsoft Learn (“Monitor network connectivity with Connection Monitor”):

“Connection Monitor (v2) enables you to monitor network connectivity between Azure and on-premises resources. You can monitor connections between Azure VMs, Azure Arc-enabled servers, and any endpoint reachable over TCP or ICMP.”

To participate in a hybrid connection, the on-premises machine must be onboarded to Azure Arc.

Azure Arc connects your non-Azure servers to Azure Resource Manager and allows management and monitoring using Azure services, including Network Watcher’s Connection Monitor.

???? Required Agent for On-Premises Monitoring

For on-premises servers (like DC1), Azure Arc uses the Azure Connected Machine agent (formerly known as the Azure Arc agent).

This agent:

Registers the on-premises machine as an Azure Arc-enabled server in Azure.

Enables the use of Azure Monitor, Defender for Cloud, Update Management, and Connection Monitor on that server.

Once the Azure Connected Machine agent is installed and the server is connected through Azure Arc, you can add it as a source or destination endpoint in Connection Monitor to measure latency and packet loss.

???? Why Other Options Are Incorrect

Option

Description

Why Incorrect

A. Log Analytics agent

Used for data collection (logs and metrics) for Azure Monitor.

❌ Does not support Connection Monitor (v2) endpoint monitoring. Deprecated in favor of Azure Monitor Agent.

B. Azure Network Watcher Agent extension

Used only on Azure VMs, not on on-premises servers.

❌ Cannot be installed on DC1 (non-Azure).

C. Azure Monitor agent extension

Used for telemetry/log ingestion into Azure Monitor.

❌ Does not support connectivity monitoring for hybrid endpoints.

✅ D. Azure Connected Machine agent

Connects on-premises servers to Azure Arc, enabling Connection Monitor and other Azure services.

✅ Correct and required.

???? Verification (Microsoft Documentation Extract)

From Microsoft Learn – “Monitor hybrid connectivity using Connection Monitor”:

“To monitor on-premises resources, onboard the servers to Azure Arc and install the Azure Connected Machine agent. This agent enables Connection Monitor to collect network connectivity data from on-premises endpoints.”

✅ Final Verified Answer:

D. the Azure Connected Machine agent for Azure Arc-enabled servers

Summary of Key Points

Connection Monitor (v2) can track network latency between Azure and on-premises systems.

On-premises servers must be Azure Arc-enabled using the Azure Connected Machine agent.

Azure VMs use the Network Watcher extension, while non-Azure machines require Azure Arc for integration.

✅ Correct Answer: D. the Azure Connected Machine agent for Azure Arc-enabled servers

In Microsoft Azure, backup vaults and Recovery Services vaults serve distinct purposes depending on the type of data source being protected. The Azure Administrator study guide and Microsoft documentation outline the following key differences and supported workloads:

Backup Vault (Azure Backup Center – Modern Vault):

The Backup vault is designed primarily for Azure Blob storage backup.

It supports backing up Azure Blobs (block blobs) in a storage account.

You can configure backup policies directly in Backup Center and use the “Azure Blobs backup” feature.

This vault type is managed using the Azure Resource Manager (ARM) model and supports new backup scenarios introduced after 2021.

Hence, in this question, cont1 (a blob container) can be backed up only to Backup1 (Backup vault).

Recovery Services Vault:

The Recovery Services vault supports backups for Azure virtual machines (VMs), Azure Files shares, on-premises workloads using the Microsoft Azure Recovery Services (MARS) agent, and SQL/SAP HANA databases on Azure VMs.

It does not support Blob container backup but does support Azure file share backup.

Therefore, share1 (a file share) must be backed up using Recovery1 (Recovery Services vault).

The Azure Backup architecture documentation emphasizes that these vaults are distinct and not interchangeable:

“Recovery Services vaults are used to back up Azure VMs, Azure Files, and on-premises workloads. Backup vaults are used to protect Azure Blobs. You cannot back up Blobs to a Recovery Services vault or back up Azure Files to a Backup vault.”

Thus, following Microsoft’s official storage backup configuration:

cont1 (Blob container) → Backup1 only

share1 (File share) → Recovery1 only

Final Verified Answer:

✅ cont1 → Backup1 only

✅ share1 → Recovery1 only

A virtual machine scale set is a group of identical virtual machines that are centrally managed, configured, and updated1. A virtual machine scale set can automatically increase or decrease the number of virtual machine instances in response to demand or a defined schedule2. A virtual machine scale set also provides high availability and fault tolerance by distributing the virtual machine instances across multiple fault domains and update domains3.

A fault domain is a logical group of underlying hardware that share a common power source and network switch. A fault domain can fail due to hardware or software failures, power outages, or network interruptions4. A virtual machine scale set can have up to five fault domains in a region.

An update domain is a logical group of underlying hardware that can undergo maintenance or be rebooted at the same time. An update domain can be affected by planned events, such as OS updates, application updates, or configuration changes4. A virtual machine scale set can have up to 20 update domains in a region.

By creating a virtual machine scale set that has 10 virtual machine instances, you can ensure that App1 always runs on at least eight virtual machines during planned Azure maintenance. This is because the default configuration of a virtual machine scale set is to have five fault domains and five update domains. This means that at any given time, only one fault domain or one update domain can be unavailable due to maintenance or failure. Therefore, at least eight out of 10 virtual machine instances will be available to run App1.

An availability set is another option for providing high availability and fault tolerance for your virtual machines. An availability set is a logical grouping of two or more virtual machines that are deployed across multiple fault domains and update domains. However, an availability set does not provide automatic scaling of resources or load balancing of traffic. You need to manually create and manage the number of virtual machine instances in an availability set.

Therefore, a virtual machine scale set is a better option than an availability set for your scenario. To create a virtual machine scale set, you can follow these steps:

Sign in to the Azure portal.

Select Create a resource > Compute > Virtual machine scale set.

On the Basics tab, enter a name for your scale set, select your subscription and resource group, select Windows Server 2019 as the image type, and enter a username and password for the administrator account.

On the Instance details tab, select the region where you want to deploy your scale set, select the size of the virtual machine instances, and enter 10 as the initial instance count.

On the Scaling tab, configure the scaling policy for your scale set based on metrics or schedule.

On the Load balancing tab, configure the load balancer for your scale set to distribute traffic across the instances.

On the Management tab, configure the diagnostics settings, automatic OS upgrades, extensions, and backup options for your scale set.

On the Advanced tab, configure the availability zone, proximity placement group, accelerated networking, host group, and custom script extension options for your scale set.

On the Tags tab, optionally add tags to your scale set resources.

On the Review + create tab, review your settings and select Create.

In this scenario, the network security group (NSG) vm1441-nsg controls inbound traffic to VM1. Azure NSGs operate using priority-based rules, where the lower number indicates a higher priority. Rules are processed in ascending order until a match is found.

From the NSG configuration in the exhibit:

Rule2 (Priority 100): Deny traffic on ports 50–60.

Rule “RDP” (Priority 300): Allow TCP 3389 (RDP).

Rule1 (Priority 400): Allow ports 50–500.

Default rules (priority 65000–65500) permit traffic within the VNet and Azure Load Balancer, and deny all others.

Azure NSGs apply first-match logic — once a rule matches, no subsequent rules are processed. The lower-numbered Rule2 (priority 100) takes precedence over Rule1 (priority 400), meaning ports 50–60 are denied before Rule1 can allow them.

Given that:

The web server typically runs on port 80 (HTTP) or 443 (HTTPS), which are not affected by Rule2 — they remain allowed by default or open firewall configuration.

The DNS server uses UDP/TCP port 53, which falls within the denied range (50–60) under Rule2.

Therefore:

While Rule2 exists, Internet users can only access the web server (port 80/443).

Once Rule2 is deleted, the deny restriction for ports 50–60 is removed, meaning both the web server (80/443) and DNS server (53) are accessible.

This aligns directly with Microsoft Azure documentation for NSGs (Microsoft Learn: “Network security groups filter network traffic to and from Azure resources by using 5-tuple rules (source, destination, port, protocol, and direction). Rules are processed in priority order, and the first match wins.”).