Correct Answer: See the explanation below.

You need to provision an Azure AD Admin for the SQL Server.

1. In the Azure portal, type SQL Server in the search box, select SQL Server from the search results then select the server named web11597200. Alternatively, browse to SQL Server in the left navigation pane.

2. In the SQL Server properties page, click on Active Directory Admin.

3. Click the Set Admin button.

4. In the Add Admin window, search for and select Danny11597200.

5. Click the Select button to add Danny11597200.

6. Click the Save button to save the changes.

Reference:

https://docs.microsoft.com/en-us/azure/azure-sql/database/authentication-aad-configure?tabs=azure-powershell

Correct Answer: See the explanation below.

You need to allow access to Azure services and configure a virtual network rule for the SQL Server.

1. In the Azure portal, type SQL Server in the search box, select SQL Server from the search results then select the server named web11597200. Alternatively, browse to SQL Server in the left navigation pane.

2. In the properties of the SQL Server, click Firewalls and virtual networks.

3. In the Virtual networks section, click on Add existing. This will open the Create/Update virtual network rule window.

4. Give the rule a name such as Allow_VNET01-Subnet0 (it doesnג€™t matter what name you enter for the exam).

5. In the Virtual network box, select VNET01.

6. In the Subnet name box, select Subnet0.

7. Click the OK button to save the rule.

8. Back in the Firewall / Virtual Networks window, set the Allow access to Azure services option to On.

NO - A read-only lock on a VM prevents all users from starting or restarting the VMs in it.

NO - A read-only lock on a RG prevents all users from starting or restarting the VMs in it.

NO - You can create new resources in RG if Delete Lock is applied but not when ReadOnly lock is applied.

https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources

Box 1: Only an owner can change permissions on resources.

Box 2: A Contributor can create/modify/delete anything in the subscription but cannot change permissions.

Correct Answer: See the explanation below.

You need to configure VNet Peering between the two networks. The questions states, "The solution must ensure that virtual machines connected to VNET1 can communicate with virtual machines connected to VNET2". It doesn't say the VMs on VNET2 should be able to communicate with VMs on VNET1. Therefore, we need to configure the peering to allow just the one-way communication.

1. In the Azure portal, type Virtual Networks in the search box, select Virtual Networks from the search results then select VNET1. Alternatively, browse to

Virtual Networks in the left navigation pane.

2. In the properties of VNET1, click on Peerings.

3. In the Peerings blade, click Add to add a new peering.

4. In the Name of the peering from VNET1 to remote virtual network box, enter a name such as VNET1-VNET2 (this is the name that the peering will be displayed as in VNET1)

5. In the Virtual Network box, select VNET2.

6. In the Name of the peering from remote virtual network to VNET1 box, enter a name such as VNET2-VNET1 (this is the name that the peering will be displayed as in VNET2).

There is an option Allow virtual network access from VNET to remote virtual network. This should be left as Enabled.

7. For the option Allow virtual network access from remote network to VNET1, click the slider button to Disabled.

8. Click the OK button to save the changes.

Reference:

https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-manage-peering

Correct Answer: See the explanation below.

To add an Azure firewall to a VNET, the VNET must first be configured with a subnet named AzureFirewallSubnet (if it doesnג€™t already exist).

Configure VNET3.

1. In the Azure portal, type Virtual Networks in the search box, select Virtual Networks from the search results then select VNET3. Alternatively, browse to

Virtual Networks in the left navigation pane.

2. In the Overview section, note the Location (region) and Resource Group of the virtual network. Weג€™ll need these when we add the firewall.

3. Click on Subnets.

4. Click on + Subnet to add a new subnet.

5. Enter AzureFirewallSubnet in the Name box. The subnet must be named AzureFirewallSubnet.

6. Enter an appropriate IP range for the subnet in the Address range box.

7. Click the OK button to create the subnet.

Add the Azure Firewall.

1. In the settings of VNET3 click on Firewall.

2. Click the Click here to add a new firewall link.

3. The Resource group will default to the VNET3 resource group. Leave this default.

4. Enter a name for the firewall in the Name box.

5. In the Region box, select the same region as VNET3.

6. In the Public IP address box, select an available public IP address if one exists, or click Add new to add a new public IP address.

7. Click the Review + create button.

8. Review the settings and click the Create button to create the firewall.

Reference:

https://docs.microsoft.com/en-us/azure/firewall/tutorial-firewall-deploy-portal

Env variable with not-secure value can be accessed in Azure portal and Azure CLI.

Env variable with secure value can be accessed within container only.

Reference:

https://docs.microsoft.com/en-us/azure/container-instances/container-instances-environment-variables#secure-values