No account needed. Every question has a worked explanation, just like the full bank.
lock_openFree sampleManage Azure Identities and Governancehard
A resource has both a role assignment granting a user access and a deny assignment that applies to the same user and action. When Azure Resource Manager evaluates the request, the role assignment is checked first and grants access, so the deny assignment is ignored. Is this statement correct?
- AYes
- BNocheck_circle Correct
Deny assignments are evaluated first and override role assignments. The grounding states deny assignments are evaluated before role assignments and that if a deny assignment applies, access is blocked regardless of role assignments. Deny assignments take precedence, so the request is blocked, not allowed.
Why A is wrong: Answering Yes assumes role assignments are checked first and win, but the grounding gives deny assignments precedence and evaluates them before role assignments.
Why B is correct: Correct. The grounding states deny assignments are evaluated before role assignments and that if a deny assignment applies, access is blocked regardless of role assignments.
lock_openFree sampleManage Azure Identities and Governancemedium
An administrator wants to manually add a specific user to a group that uses dynamic membership. Statement: An administrator can manually add or remove a member of a dynamic membership group. Is this statement correct?
- AYes
- BNocheck_circle Correct
Dynamic group membership is rule-driven only, so members cannot be added or removed by hand. No is correct because membership of a dynamic membership group is computed automatically: the system evaluates the rule when attributes change and adds users who satisfy it or removes those who no longer do. The documentation states you can't manually add or remove a member of such a group, so a manual add is not possible.
Why A is wrong: The documentation states you can't manually add or remove a member of a dynamic membership group; membership is determined solely by whether the user satisfies the rule. To include the extra person, the rule must change or the user's attributes must match it.
Why B is correct: Correct. No is correct because membership of a dynamic membership group is computed automatically: the system evaluates the rule when attributes change and adds users who satisfy it or removes those who no longer do.
lock_openFree sampleMonitor and Maintain Azure Resourcesmedium
An administrator reviews which data sources a diagnostic setting can collect and route to destinations. Which sources are valid diagnostic setting sources? (Select 3 answers)
- APlatform metrics produced automatically by the monitored resourcecheck_circle Correct
- BResource logs that are not gathered until a setting enables themcheck_circle Correct
- CActivity log entries describing operations on the subscriptioncheck_circle Correct
- DPrometheus metrics scraped from a managed Kubernetes cluster
- ECustom metrics pushed straight from an instrumented application
The diagnostic setting sources are platform metrics, the activity log, and resource logs; Prometheus and custom metrics use other pipelines. Diagnostic settings collect from three sources: platform metrics and the activity log, both gathered automatically, and resource logs, which are off by default until a setting enables them.
Why A is correct: Correct. Platform metrics produced automatically by the monitored resource is one of the keyed answers. Diagnostic settings collect from three sources: platform metrics and the activity log, both gathered automatically, and resource logs, which are off by default until a setting enables them.
Why B is correct: Correct. Resource logs that are not gathered until a setting enables them is one of the keyed answers. Diagnostic settings collect from three sources: platform metrics and the activity log, both gathered automatically, and resource logs, which are off by default until a setting enables them.
Why C is correct: Correct. Activity log entries describing operations on the subscription is one of the keyed answers. Diagnostic settings collect from three sources: platform metrics and the activity log, both gathered automatically, and resource logs, which are off by default until a setting enables them.
Why D is wrong: Prometheus metrics flow to an Azure Monitor workspace through managed Prometheus, not through a diagnostic setting source.
Why E is wrong: Custom metrics enter via the custom metrics API or Application Insights, not as a diagnostic setting source.
