The way to give a resource management permissions is using System-Assigned Identity, on which the resource become an identity itself in Azure AD.

And the AFTER that, you assign that identity to the RG in question, let's say with Contributor role, which would give the VM the permissions to do the required changes.

Correct answer is "A"

https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/tutorial-windows-vm-access-arm

B is correct answer.

A recovery service vault can not deleted unless all its backups are deleted permanently. And along with that definitely resource lock has to be removed on vnet.

https://docs.microsoft.com/en-us/azure/backup/backup-azure-delete-vault?tabs=portal

Correct Answer: A

An NS record or (name server record) tells recursive name servers which name servers are authoritative for a zone. You can have as many NS records as you would like in your zone file. The benefit of having multiple NS records is the redundancy of your DNS service.

You need to create a name server (NS) record for the zone.

Reference:

https://docs.microsoft.com/en-us/azure/dns/delegate-subdomain

The question should specify if by "Add a record to the public contoso.com DNS zone" it means adding the text record to the domain registrar's DNS zone. All that is needed is:

- Add a custom domain

- Create the Txt record (including hostname @, text value and TTL set to 3600 seconds) to DNS record on domain registrar.

- Verify the domain.

Having an Azure Public DNS zone is not required. Just tested this.

https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/add-custom-domain

Correct Answer: C

A: URL of the Storage Account.

B: The azcopy sync command replicates the source location to the destination location. However, the file is skipped if the last modified time in the destination is more recent.

C: The azcopy copy command copies a directory (and all the files in that directory) to a blob container. The result is a directory in the container by the same name.

D: The az storage blob copy start-batch command copies multiple blobs to a blob container.

Reference:

https://docs.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-blobs

https://docs.microsoft.com/en-us/azure/storage/common/storage-ref-azcopy-copy

Correct Answer: D

Azure Import/Export service supports the following of storage accounts:

✑ Standard General Purpose v2 storage accounts (recommended for most scenarios)

✑ Blob Storage accounts

✑ General Purpose v1 storage accounts (both Classic or Azure Resource Manager deployments),

Azure Import/Export service supports the following storage types:

✑ Import supports Azure Blob storage and Azure File storage

✑ Export supports Azure Blob storage. Azure Files not supported.

Only storage4 can be exported.

Reference:

https://docs.microsoft.com/en-us/azure/storage/common/storage-import-export-requirements

For the Box1: Storage1 and Storage2 because:

*** Storage1:

- General-purpose v1 accounts: Legacy account type for blobs, files, queues, and tables. Use general-purpose v2 accounts instead when possible.

*** Storage2:

- General-purpose v2 accounts: Basic storage account type for blobs, files, queues, and tables. Recommended for most scenarios using Azure Storage.

Box 2: All storage accounts..

https://docs.microsoft.com/en-us/azure/storage/common/storage-account-overview

Answer is correct. B - Blob Container.

For Azure file share, it is tricky as it is mentioned Azure Files can be used for export and import. We can test especially with file share and it doesn't work. Maybe work for storage account with type file or something. but not Azure file shares.

https://docs.microsoft.com/en-us/azure/import-export/storage-import-export-requirements#supported-storage-types

Box 1: Access Control (IAM)

Since the App1 uses Managed Identity, App1 can access the Storage Account via IAM. As per requirement, we need to minimize the number of secrets used, so Access keys is not ideal.

Box 2: Shared access signatures (SAS)

We need temp access for App2, so we need to use SAS.

Reference:

https://docs.microsoft.com/en-us/azure/storage/common/storage-auth

Keep in mind the question is mentioning the minimize cost, even though Storage v2 and blob both can support the hot, cool, and archive but Storage V2 is lowest cost. so answer is correct.

https://docs.microsoft.com/en-us/azure/storage/common/storage-redundancy-grs

https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-storage-tiers