Dit deel is nog niet vertaald. Je ziet de Engelse tekst.
$ als gewone gebruiker# als root (of met sudo)
Identity and governance
Users, groups, roles, policies, locks, tags and costs.
| Task | Short answer |
|---|---|
| New IT staff must get access automatically | Dynamic group user.department -eq "IT" (Entra ID P1) — lesson |
| A team may manage VMs but not give access | Virtual Machine Contributor on the resource group — lesson |
| Only start/stop/restart VMs | Custom role with those actions — lesson |
| Resources only in West and North Europe | Policy "Allowed locations", effect Deny — lesson |
| Nobody may delete the production database | CanNotDelete lock — lesson |
| Alert at 80 % of the monthly budget | Cost Management budget with alert — lesson |
Storage
Accounts, access and data.
| Task | Short answer |
|---|---|
| Survive the loss of one data centre | ZRS (or GZRS) — lesson |
| A partner may read one container for 7 days | User delegation SAS or stored access policy — lesson |
| An app reads blobs without keys | Managed identity + Storage Blob Data Reader — lesson |
| Move backups to Archive after 90 days, delete after a year | Lifecycle management rule — lesson |
| Recover an overwritten blob | Versioning (or soft delete) — lesson |
Compute
Templates, VMs, containers and App Service.
| Task | Short answer |
|---|---|
| Check what a template would change | az deployment group what-if — lesson |
| 99.99 % SLA for two VMs | Place them in different availability zones — lesson |
| Add VMs automatically when CPU > 70 % | Scale set + autoscale rule — lesson |
| Deploy a new version with no downtime and easy undo | Deployment slot + swap — lesson |
| Run a container for a short job | Azure Container Instances — lesson |
Networking
VNets, security and load balancing.
| Task | Short answer |
|---|---|
| Two VNets must talk privately | VNet peering, both directions — lesson |
| All internet traffic of a subnet through a firewall | Route table with 0.0.0.0/0 → VirtualAppliance — lesson |
| Allow web → db on 5432 by role, not IP | Application security groups in an NSG rule — lesson |
| SSH to VMs without public IPs | Azure Bastion — lesson |
| Storage only through a private IP | Private endpoint + private DNS zone — lesson |
| Why can VM A not reach VM B on 443? | Network Watcher: IP flow verify, next hop, connection troubleshoot — lesson |
Monitor and maintain
Monitor, alerts, backup and recovery.
Plan the exam day
The exam has multiple-choice questions, case studies and sometimes tasks in a lab-like interface.
- Try the exam sandbox before the day, to know the interface.
- Microsoft Learn is open during the exam (a link in the exam) — but it costs time. Know the basics without it.
- Mark hard questions and come back; case studies can not be revisited after you leave them.
Next phase: Terraform — build the same environment with code.