You save $69.98
A risk reviewer is considering an Azure design that aims to: select an appropriate larger VM size using Azure's resize process and operational impact plan. Which limitation should still be documented?
VM resize can require downtime and is limited by region, zone and quota availability. That remains a practical service boundary even after the recommended change (review the VM family/region/availability compatibility and resize to a supported SKU with sufficient memory) is implemented; retest it when identities, policies, service capacity or network paths change.
The two checks cover separate behavior: 'Verify the VM reports the new size and intended memory after restart' and 'Run a representative workload test and monitor memory pressure and throughput'. Neither check removes the remaining operational limitation: VM resize can require downtime and is limited by region, zone and quota availability.
The incident (the VM upgrade fails because the selected size is unavailable in the current deployment cluster) could recur if a related Azure dependency changes. The design still faces the limitation: VM resize can require downtime and is limited by region, zone and quota availability.
The successful check 'Verify the VM reports the new size and intended memory after restart' proves only the tested behavior and cannot eliminate every dependent failure. The specific remaining limitation is: VM resize can require downtime and is limited by region, zone and quota availability.
A production subscription has this use case: A security team requires VM disk data to be protected while physically stored on the Azure host, including eligible temporary disk data. The owner specifies: enable host-level encryption for supported Azure virtual machines. What is the best administrative approach?
Encryption at host provides an Azure platform control for stored VM data at the host boundary where supported. This achieves enable host-level encryption for supported Azure virtual machines through configure encryption at host on compatible VM types and regions before relying on the protection instead of relying on merely similar resource settings.
Transport security and host storage encryption are different controls; that would not meet enable host-level encryption for supported Azure virtual machines, for which the relevant Azure action is configure encryption at host on compatible VM types and regions before relying on the protection.
Network filtering does not encrypt host-stored blocks; that would not meet enable host-level encryption for supported Azure virtual machines, for which the relevant Azure action is configure encryption at host on compatible VM types and regions before relying on the protection.
Azure RBAC does not enable encryption at host; that would not meet enable host-level encryption for supported Azure virtual machines, for which the relevant Azure action is configure encryption at host on compatible VM types and regions before relying on the protection.
An Azure administrator is investigating this symptom: The VM reports encryption at host disabled despite the required host storage protection. Which root cause best matches the underlying requirement: enable host-level encryption for supported Azure virtual machines?
The trace reports: The VM reports encryption at host disabled despite the required host storage protection. The causal misconfiguration is: The feature is not enabled or the VM size/region does not support it. The targeted action is to enable encryption at host with a supported size and configuration, following any required VM change sequence.
The VMs lack required fault-domain and update-domain distribution. That mechanism would be more consistent with an observation such as routine host maintenance interrupts both instances because the service was deployed without a suitable availability strategy, rather than this case's the VM reports encryption at host disabled despite the required host storage protection.
The autoscale profile or associated metric threshold and capacity limits are misconfigured; that mechanism would be more consistent with an observation such as cPU remains high while the scale set stays at one instance despite a documented scale-out requirement, rather than this case's the VM reports encryption at host disabled despite the required host storage protection.
The deployment pinned both replicas to the same availability zone; that mechanism would be more consistent with an observation such as a zonal outage takes down both active application VMs, rather than this case's the VM reports encryption at host disabled despite the required host storage protection.
An Azure rollout fails because: The VM reports encryption at host disabled despite the required host storage protection. Which change most directly restores the intended control?
Enable encryption at host with a supported size and configuration, following any required VM change sequence. This addresses the documented failure condition: the feature is not enabled or the VM size/region does not support it. Retest the affected operation and retain the original least-privilege boundaries.
Azure RBAC does not enable encryption at host. In the reported incident (the VM reports encryption at host disabled despite the required host storage protection), that change would not correct the cause: the feature is not enabled or the VM size/region does not support it.
Transport security and host storage encryption are different controls. In the reported incident (the VM reports encryption at host disabled despite the required host storage protection), that change would not correct the cause: the feature is not enabled or the VM size/region does not support it.
Network filtering does not encrypt host-stored blocks. In the reported incident (the VM reports encryption at host disabled despite the required host storage protection), that change would not correct the cause: the feature is not enabled or the VM size/region does not support it.
For the configuration goal, enable host-level encryption for supported Azure virtual machines. The Azure context is: A security team requires VM disk data to be protected while physically stored on the Azure host, including eligible temporary disk data. Which TWO observations provide useful assurance? Select TWO answers.
Inspect the VM's encryptionAtHost configuration after enabling the feature. This supplies observed evidence for enable host-level encryption for supported Azure virtual machines. It is not interchangeable with the second required check, validate guest boot and data availability after the configuration change, because that checks a separate success or failure boundary.
Validate guest boot and data availability after the configuration change. This supplies observed evidence for enable host-level encryption for supported Azure virtual machines. It is not interchangeable with the second required check, inspect the VM's encryptionAtHost configuration after enabling the feature, because that checks a separate success or failure boundary.
A release checklist recording 'Validate guest boot and data availability after the configuration change' is not evidence that the required operation actually succeeded or failed. To establish the correct result, the team must validate guest boot and data availability after the configuration change on the actual workload to prove its independent boundary.
A configured resource is not proof of live behavior. The relevant result must be observed by inspecting the VM's encryptionAtHost configuration after enabling the feature on the affected Azure deployment.
A privileged administrator in a different subscription may succeed at 'Inspect the VM's encryptionAtHost configuration after enabling the feature' even though the intended caller fails. This does not prove the required behavior for inspect the vm's encryptionathost configuration after enabling the feature.
A stakeholder asks whether the proposed configuration guarantees: enable host-level encryption for supported Azure virtual machines. What qualification is technically accurate?
Encryption at host is not equivalent to application-level encryption or a guarantee against compromised in-guest administrators. That remains a practical service boundary even after the recommended change (configure encryption at host on compatible VM types and regions before relying on the protection) is implemented; retest it when identities, policies, service capacity or network paths change.
The incident (the VM reports encryption at host disabled despite the required host storage protection) could recur if a related Azure dependency changes. The design still faces the limitation: Encryption at host is not equivalent to application-level encryption or a guarantee against compromised in-guest administrators.
The successful check 'Inspect the VM's encryptionAtHost configuration after enabling the feature' proves only the tested behavior and cannot eliminate every dependent failure. The specific remaining limitation is: Encryption at host is not equivalent to application-level encryption or a guarantee against compromised in-guest administrators.
The two checks cover separate behavior: 'Inspect the VM's encryptionAtHost configuration after enabling the feature' and 'Validate guest boot and data availability after the configuration change'. Neither check removes the remaining operational limitation: Encryption at host is not equivalent to application-level encryption or a guarantee against compromised in-guest administrators.
A production subscription has this use case: A trading workload needs predictable resilience against a single availability-zone failure in a supported Azure region. The owner specifies: place independent application VMs in different availability zones. What is the best administrative approach?
Availability zones provide distinct datacenter-level fault domains within a region, reducing common zonal failure risk. This achieves place independent application VMs in different availability zones through deploy redundant VMs into separate Azure availability zones and configure traffic handling appropriately instead of relying on merely similar resource settings.
The same zonal outage can impact both replicas; that would not meet place independent application VMs in different availability zones, for which the relevant Azure action is deploy redundant VMs into separate Azure availability zones and configure traffic handling appropriately.
Vertical sizing does not provide separate fault domains; that would not meet place independent application VMs in different availability zones, for which the relevant Azure action is deploy redundant VMs into separate Azure availability zones and configure traffic handling appropriately.
A lock does not keep the VM alive during infrastructure failure; that would not meet place independent application VMs in different availability zones, for which the relevant Azure action is deploy redundant VMs into separate Azure availability zones and configure traffic handling appropriately.
An Azure administrator is investigating this symptom: A zonal outage takes down both active application VMs. Which root cause best matches the underlying requirement: place independent application VMs in different availability zones?
The trace reports: A zonal outage takes down both active application VMs. The causal misconfiguration is: The deployment pinned both replicas to the same availability zone. The targeted action is to rebuild or redeploy suitable replicas across separate zones and verify traffic distribution.
The proposed mechanism concerns both active VMs were confirmed serving traffic from separate availability zones throughout the reported single-zone outage, which is not established by the observed a zonal outage takes down both active application VMs. Test the more directly supported condition: The deployment pinned both replicas to the same availability zone.
The VMs lack required fault-domain and update-domain distribution. That mechanism would be more consistent with an observation such as routine host maintenance interrupts both instances because the service was deployed without a suitable availability strategy, rather than this case's a zonal outage takes down both active application VMs.
The autoscale profile or associated metric threshold and capacity limits are misconfigured; that mechanism would be more consistent with an observation such as cPU remains high while the scale set stays at one instance despite a documented scale-out requirement, rather than this case's a zonal outage takes down both active application VMs.
An Azure rollout fails because: A zonal outage takes down both active application VMs. Which change most directly restores the intended control?
Rebuild or redeploy suitable replicas across separate zones and verify traffic distribution. This addresses the documented failure condition: the deployment pinned both replicas to the same availability zone. Retest the affected operation and retain the original least-privilege boundaries.
A lock does not keep the VM alive during infrastructure failure. In the reported incident (a zonal outage takes down both active application VMs), that change would not correct the cause: the deployment pinned both replicas to the same availability zone.
The same zonal outage can impact both replicas. In the reported incident (a zonal outage takes down both active application VMs), that change would not correct the cause: the deployment pinned both replicas to the same availability zone.
Vertical sizing does not provide separate fault domains. In the reported incident (a zonal outage takes down both active application VMs), that change would not correct the cause: the deployment pinned both replicas to the same availability zone.
For the configuration goal, place independent application VMs in different availability zones. The Azure context is: A trading workload needs predictable resilience against a single availability-zone failure in a supported Azure region. Which TWO observations provide useful assurance? Select TWO answers.
Inspect each VM's zone metadata and confirm they differ. This supplies observed evidence for place independent application VMs in different availability zones. It is not interchangeable with the second required check, simulate one replica becoming unavailable and verify the other still handles requests, because that checks a separate success or failure boundary.
Simulate one replica becoming unavailable and verify the other still handles requests. This supplies observed evidence for place independent application VMs in different availability zones. It is not interchangeable with the second required check, inspect each VM's zone metadata and confirm they differ, because that checks a separate success or failure boundary.
A configured resource is not proof of live behavior. The relevant result must be observed by inspecting each VM's zone metadata and confirm they differ on the affected Azure deployment.
A privileged administrator in a different subscription may succeed at 'Inspect each VM's zone metadata and confirm they differ' even though the intended caller fails. This does not prove the required behavior for inspect each vm's zone metadata and confirm they differ.
A release checklist recording 'Simulate one replica becoming unavailable and verify the other still handles requests' is not evidence that the required operation actually succeeded or failed. To establish the correct result, the team must simulate one replica becoming unavailable and verify the other still handles requests on the actual workload to prove its independent boundary.
A stakeholder asks whether the proposed configuration guarantees: place independent application VMs in different availability zones. What qualification is technically accurate?
Zones improve fault isolation but do not eliminate region-wide outages or application-level single points of failure. That remains a practical service boundary even after the recommended change (deploy redundant VMs into separate Azure availability zones and configure traffic handling appropriately) is implemented; retest it when identities, policies, service capacity or network paths change.
The successful check 'Inspect each VM's zone metadata and confirm they differ' proves only the tested behavior and cannot eliminate every dependent failure. The specific remaining limitation is: Zones improve fault isolation but do not eliminate region-wide outages or application-level single points of failure.
The two checks cover separate behavior: 'Inspect each VM's zone metadata and confirm they differ' and 'Simulate one replica becoming unavailable and verify the other still handles requests'. Neither check removes the remaining operational limitation: Zones improve fault isolation but do not eliminate region-wide outages or application-level single points of failure.
The incident (a zonal outage takes down both active application VMs) could recur if a related Azure dependency changes. The design still faces the limitation: Zones improve fault isolation but do not eliminate region-wide outages or application-level single points of failure.
or Guarantee your success by buying the full version which covers the full latest pool of questions. (606 Questions, Last Updated on Oct 25, 2026)
Please check your mailbox for a message from support@examlabs.com and follow the directions.
