Question 400 A private backend microservice should not be exposed directly as a public website. What should designers evaluate in managed container hosting? Disabling all container health reporting Making the image repository public as the access control Increasing the image tag length Internal ingress and network access controls supported by the chosen service Explanation Correct Answer D:Traffic exposure should match the backend's private consumer requirements. Incorrect Answers A:Missing diagnostics won't enforce private ingress. B:Registry visibility is different from runtime ingress security. C:Tag naming doesn't set network exposure.
Question 401 A training lab runs Azure VMs only during office hours. Which VM setting directly limits evening compute charges without deleting the machines? Add a higher-throughput managed disk Change the VMs' resource tags without automation Create another availability set Configure VM automatic shutdown for the lab schedule Explanation Correct Answer D:Automatic shutdown stops assigned compute during known nonuse windows. Incorrect Answers A:Disk speed doesn't stop paid running VM compute. B:Tag labels alone don't change power state. C:Availability placement does not stop an idle VM.
Question 402 An engineer deallocates a nonproduction Azure VM and sees no more VM compute charges, but the subscription still incurs a charge. Which retained resource most directly explains it? The deallocated VM still consumes its former full compute-hour allocation A stopped VM always converts its managed disks to free temporary disks The subscription automatically charges for all unused virtual cores as active VMs The attached managed OS and data disks continue to incur storage charges Explanation Correct Answer D:Deallocation preserves attached managed disks, whose storage charges can continue independently of compute. Incorrect Answers A:Deallocation stops compute allocation charges; it does not prove that every other resource is free. B:Managed disks remain billed storage resources unless removed or otherwise changed. C:Unused vCPUs from a deallocated VM are not automatically billed as running instances.
Question 403 A stable VM workload will run continuously for years. What purchasing option may reduce compute price compared with pure pay-as-you-go? An eligible Azure reservation or savings plan aligned to usage Creating extra availability zones in the subscription Moving the VM to a different resource group each month Reserve a VM capacity commitment without checking eligibility for the workload's actual usage Explanation Correct Answer A:Long-term usage commitments can discount eligible compute consumption. Incorrect Answers B:Zone selection doesn't imply a purchasing commitment. C:Administrative grouping doesn't earn reservation pricing. D:Discount or capacity commitments have specific scope and eligibility rules and may not match intermittent use.
Question 404 A small application usually has low CPU needs but has brief CPU spikes. Which VM family property might be appropriate to evaluate? A larger static guest OS paging file as a CPU purchase Increase the VM's public IP count to compensate for exhausted CPU credits Burstable VM sizes with their CPU-credit behavior Storage redundancy tiers as the sole CPU strategy Explanation Correct Answer C:A burstable SKU can meet brief spikes when its credit and baseline limits match the load. Incorrect Answers A:Paging is not additional processor capacity. B:Addresses cannot replenish the CPU burst credits used by a burstable VM size. D:Storage copies do not supply vCPU bursts.
Question 405 A VM needs to communicate inside an Azure virtual network. Which resource attachment establishes its network connection? A resource lock on its managed disk A billing profile for the tenant A network interface connected to the desired subnet A storage lifecycle rule Explanation Correct Answer C:A VM NIC supplies its private network attachment and related IP configuration. Incorrect Answers A:Locks do not provide network packets. B:Billing profiles are not network interfaces. D:Object retention policy is not VM connectivity.
Question 406 A network appliance VM requires separate interfaces for internal and external traffic. What capability must the team confirm? That the VM name contains two hyphens That Azure Policy is disabled tenant-wide That a storage account has two containers That the chosen VM size supports the required number of network interfaces Explanation Correct Answer D:NIC count limits depend on the VM SKU and configuration. Incorrect Answers A:Naming does not change supported interface limits. B:Removing governance doesn't increase a VM size's hardware limits. C:Blob containers are unrelated to VM NIC count.
Question 407 A Linux VM should install a package during initial provisioning using configuration supplied at deployment. Which technique supports this? A region pair alone Cloud-init or supported VM provisioning extensions A subscription cost tag Put the installation script only in an administrator's notes rather than the VM's supported initialization path Explanation Correct Answer B:Startup automation can apply initial instance configuration. Incorrect Answers A:Regional relationships do not configure guest software. C:A tag doesn't install a package. D:A note does not run the bootstrap steps automatically at VM creation.
Question 408 An administrator needs a supported agent configured inside a VM after deployment without manually logging into each server. Which Azure capability can help? Azure availability zone selection Azure VM extensions Azure resource locks Azure Cost Management export Explanation Correct Answer B:Extensions enable supported post-provision guest configuration and agent deployment. Incorrect Answers A:Zone placement is unrelated to agent installation. C:Locks can restrict management operations but don't install software. D:Usage reports don't install VM agents.
Question 409 A VM must keep its application database separately from the operating-system volume. Which disk configuration is most appropriate? Store every write only in the temporary resource disk attached to the VM Use an Azure Policy assignment as the database disk Put both the database and operating system on the same OS disk partition Attach a managed data disk in addition to the OS disk Explanation Correct Answer D:Separating data storage supports independent volume management. Incorrect Answers A:Temporary disks are not suitable for durable database data across host changes or maintenance. B:Policy is a governance resource, not block storage. C:Mixing both workloads on the OS volume defeats the stated separation of application data and system disk.
Question 410 A team creates one point-in-time snapshot of a VM's data disk and assumes this is a full application-aware recovery strategy. What must it evaluate? Whether the VM is tagged as 'production' Assume a disk snapshot automatically captures the whole multi-tier application state Whether the snapshot resource name ends with 'safe' Consistency requirements and a supported backup/recovery process Explanation Correct Answer D:Disk snapshots alone may not capture application transaction consistency or a complete recovery workflow. Incorrect Answers A:Metadata doesn't make a snapshot application-consistent. B:A disk recovery point does not by itself coordinate application consistency across all dependencies. C:Naming is not a recovery guarantee.
