Try each one before opening the answer. Every option is explained, with the Microsoft documentation page that proves it.
Question 1 · choose 2
You must enable encryption at host on an existing VM that runs a VM size that supports it. The subscription has never used the feature. Which two actions are required? (Choose TWO.)
AEnable Azure Disk Encryption on the OS disk first
BRegister the EncryptionAtHost feature for Microsoft.Compute
CCreate a disk encryption set with a customer-managed key
DDeallocate the VM before you change the setting
EConvert the OS disk to Premium SSD v2
Show the answer and why
AEnable Azure Disk Encryption on the OS disk first
Incorrect
Encryption at host can't be enabled on VMs that have, or ever had, Azure Disk Encryption.
BRegister the EncryptionAtHost feature for Microsoft.Compute
Correct
The feature must be registered in the subscription, and show Registered, before you can turn it on.
CCreate a disk encryption set with a customer-managed key
Incorrect
Customer-managed keys are optional; encryption at host works with platform-managed keys.
DDeallocate the VM before you change the setting
Correct
Existing VMs must be deallocated and reallocated to be encrypted at host.
EConvert the OS disk to Premium SSD v2
Incorrect
Encryption at host doesn't depend on the disk type; Premium SSD v2 is a performance choice.
Encryption at host encrypts the temp disk and the OS and data disk caches at the VM host. Register the EncryptionAtHost feature, then deallocate the VM and set securityProfile.encryptionAtHost to true. It can't coexist with Azure Disk Encryption, which retires on 15 September 2028.
VM1 runs on its own. You need it in availability set AS-Web with VM2 and VM3 so that planned maintenance never takes all three down together. What must you do?
ADeallocate VM1, then change its availability set to AS-Web
BRun Move-AzResource to move VM1 into AS-Web
CDelete VM1 keeping its disks, and recreate it in AS-Web
DRaise AS-Web to 4 fault domains so it can accept VM1
Show the answer and why
ADeallocate VM1, then change its availability set to AS-Web
Incorrect
The availability set can be chosen only when a VM is created; deallocating the VM doesn't open that setting.
BRun Move-AzResource to move VM1 into AS-Web
Incorrect
Move-AzResource changes a resource's group or subscription; it doesn't change a VM's availability set.
CDelete VM1 keeping its disks, and recreate it in AS-Web
Correct
To change the availability set, you delete the VM and recreate it from its disks with the new availability set.
DRaise AS-Web to 4 fault domains so it can accept VM1
Incorrect
An availability set has up to 3 fault domains, and its settings can't be changed after it's created.
You add a VM to an availability set only when you create it. To change it, delete the VM with its disks set to detach, then recreate the VM from the disks inside the availability set. A set has up to 3 fault domains and 20 update domains.
You try to resize a running VM from D2s_v5 to an M-series size. The portal doesn't list the M-series size for the running VM. The size is offered in the region. What should you do?
ADeallocate the VM, resize it, then start it
BRedeploy the VM, then resize it while it runs
CDetach the data disks, then resize the VM
DCapture an image and create the VM in a new region
Show the answer and why
ADeallocate the VM, resize it, then start it
Correct
When the new size isn't available on the current hardware cluster, the VM must be deallocated so it can be placed on hardware that offers it.
BRedeploy the VM, then resize it while it runs
Incorrect
Redeploy moves the VM to a new host for troubleshooting; it doesn't make a different size family available to a running VM.
CDetach the data disks, then resize the VM
Incorrect
Disks don't limit which sizes the hardware cluster offers, so detaching them doesn't help.
DCapture an image and create the VM in a new region
Incorrect
The size is offered in the current region, so moving regions isn't needed.
Sizes not offered on the cluster hosting a running VM appear only after the VM is deallocated. Deallocation releases dynamic IP addresses but keeps the disks; a VM in an availability set may need every VM in the set deallocated.
You plan one Virtual Machine Scale Set for a workload that runs some Windows VMs and some Linux VMs, and you want to manage each instance with the standard VM commands. Which configuration supports this?
AUniform orchestration with a single VM profile
BUniform orchestration with overprovisioning disabled
CFlexible orchestration
DAn availability set with three fault domains
Show the answer and why
AUniform orchestration with a single VM profile
Incorrect
Uniform builds identical instances from one profile, so Windows and Linux can't share the set.
BUniform orchestration with overprovisioning disabled
Incorrect
Overprovisioning affects how many extra VMs are created during scale-out, not which operating systems the set can hold.
CFlexible orchestration
Correct
In Flexible mode, Linux and Windows VMs can reside in the same scale set, and instances are standard VMs managed with standard VM APIs.
DAn availability set with three fault domains
Incorrect
An availability set groups VMs for fault isolation but provides no scale set management or autoscale.
Flexible orchestration manages standard Azure VMs and supports mixed VM types, including Windows and Linux in one set, up to 1,000 VMs. Uniform orchestration deploys identical instances from a single model.
You must move VM1 and its disks, NIC and virtual network from West Europe to North Europe in the same subscription. Which tool is designed for this move?
AThe Move to another resource group action
BMove-AzResource with the target region
CThe Redeploy action on the VM
DAzure Resource Mover
Show the answer and why
AThe Move to another resource group action
Incorrect
Moving between resource groups changes only the resource group; the region of the resources stays the same.
BMove-AzResource with the target region
Incorrect
Move-AzResource moves resources between resource groups and subscriptions; it has no target region.
CThe Redeploy action on the VM
Incorrect
Redeploy moves the VM to a new host in the same region to fix host issues.
DAzure Resource Mover
Correct
Resource Mover moves resources across regions, validates them and resolves their dependencies, such as disks and networks.
A resource move between groups or subscriptions doesn't change a resource's region. To move VMs and related resources to another region, use Azure Resource Mover, which handles dependency analysis and the move steps.
Caz vm image create -g rg1 -n vm1 --source Ubuntu2204
Incorrect
Image commands work with images, not VMs.
Daz vm create -g rg1 -n vm1 --image Ubuntu2204 --generate-ssh-keys
Correct
az vm create with an image alias and --generate-ssh-keys creates the VM and the key pair if none exists.
az vm create builds the VM, its NIC, public IP and NSG by default. Use an image alias such as Ubuntu2204 and --generate-ssh-keys for key-based sign-in.
You must install the same internal agent package on hundreds of VMs and scale set instances, and update it by publishing new versions. Which feature is built for this?
AA managed image that includes the agent
BBoot diagnostics on each VM
CVM Applications in Azure Compute Gallery
DRun Command run on each VM
Show the answer and why
AA managed image that includes the agent
Incorrect
Baking the agent into an image means rebuilding the image and redeploying for each update.
BBoot diagnostics on each VM
Incorrect
Boot diagnostics helps troubleshooting; it doesn't install software.
CVM Applications in Azure Compute Gallery
Correct
VM Applications package an app, version it in a gallery and deploy it to VMs and scale sets.
DRun Command run on each VM
Incorrect
Run Command runs scripts one VM at a time and doesn't track app versions.
VM Applications are a gallery resource that stores application packages and versions and deploys them to VMs and scale sets, separate from the base image.
Policy requires that a VM's managed disks be encrypted at rest with a key the company controls in Key Vault. Which resource should the disks reference?
AA disk encryption set that points to the key
BA stored access policy
CAn encryption scope
DA storage account with infrastructure encryption
Show the answer and why
AA disk encryption set that points to the key
Correct
Server-side encryption with customer-managed keys uses a disk encryption set that references the Key Vault key.
BA stored access policy
Incorrect
Stored access policies govern SAS tokens.
CAn encryption scope
Incorrect
Encryption scopes apply to blob containers, not managed disks.
DA storage account with infrastructure encryption
Incorrect
Managed disks aren't placed in your storage accounts.
Managed disks are encrypted with platform keys by default. To use your own key, create a disk encryption set linked to a Key Vault key and associate it with the disks.
A small web VM averages 10 percent CPU, with short spikes when reports run. You want the cheapest size that handles the spikes. Which size family fits?
AL-family storage-optimized
BM-family memory-optimized
CB-family burstable
DN-family GPU
Show the answer and why
AL-family storage-optimized
Incorrect
L-family targets high disk throughput, not light compute.
BM-family memory-optimized
Incorrect
M-family targets very large in-memory workloads.
CB-family burstable
Correct
B-family VMs bank credits while CPU is low and burst above their baseline when needed.
DN-family GPU
Incorrect
N-family adds GPUs, unnecessary for this app.
Burstable B-family sizes run at a baseline CPU and accumulate credits to burst, which suits workloads that are idle most of the time.