Remove peering between VNet1 and VNet2: Historically, Azure prevented address space modifications on peered networks, requiring the peering to be removed first. While newer updates allow address space changes while peered, the remote network (VNet2) will not recognize the new routes until the peering is updated. Since the "Sync" action is not an available option in this list, you must perform the manual equivalent: removing the peering connection.

Add the 10.33.0.0/16 address space to VNet1: Once the peering constraint is removed (or as the primary configuration step), you add the new CIDR block to the virtual network's address space.

Recreate peering between VNet1 and VNet2: Finally, you must establish the peering link again. When the peering is recreated, VNet2 will automatically detect the updated address space of VNet1 (including the new 10.33.0.0/16 range) and configure the necessary routing tables to allow communication between hosts.

A. Disassociating the NSG removes all its rules, permitting not blocking Internet access.

B. Inbound rules govern traffic entering the VM; they do not control outbound traffic to

websites.

D. The outbound deny rule already blocks port 80; no modification is required its scope

must simply include both VMs.

Microsoft Learn - Create, change, or delete a virtual network peering: "If you add an address range to a virtual network that is peered with another virtual network, you must sync the peering on the remote virtual network... If the peering status is Connected, you can't edit the peering settings [without syncing or recreating]."

Source: learn.microsoft.com/en-us/azure/virtual-network/virtual-network-manage-peering#resize-virtual-network-address-space

Microsoft Learn - Virtual network peering overview: Explains that address space changes require a peering update (Sync) or recreation to take effect.

Source: learn.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview

A storage account can be live-migrated to zone-redundant storage only when it is

1. a General-purpose v2 account,

2. configured for Standard performance,

3. currently replicated as GRS or RA-GRS, and

4. located in a region that already offers ZRS.

Among the listed accounts, only storage2 meets every requirement (GPv2, Standard, GRS,

in a ZRS-supported region), so it is the sole candidate for Microsoft-supported live migration

to ZRS.

A. storage1 Uses LRS; migration is supported only from GRS/RA-GRS.

C. storage3 Blob Storage account type; live migration feature supports only GPv2.

D. storage4 GPv1 (not v2) or premium performance (unsupported for live migration).

1. Microsoft Docs Migrate to ZRS or GZRS by requesting a live migration

https://learn.microsoft.com/azure/storage/common/redundancy-migration#prerequisites

(GPv2, Standard, GRS/RA-GRS, ZRS region).

2. Microsoft Docs Change how your storage account is replicated

https://learn.microsoft.com/azure/storage/common/storage-accountmove?tabs=portal#limitations (unsupported for LRS, Blob, Premium, GPv1).

The provided ARM template uses the schema

https://schema.management.azure.com/schemas/2018-0501/subscriptionDeploymentTemplate.json#. This schema indicates that the template is

designed for a subscription-level deployment. Subscription-level deployments are used to

create resources directly within a subscription, such as resource groups, or to deploy

resources across multiple resource groups. The template first defines a resource of type

Microsoft.Resources/resourceGroups to create a new resource group, and then uses a

nested deployment (Microsoft.Resources/deployments) to deploy an Azure Storage account

into that newly created resource group. The New-AzDeployment cmdlet is used to deploy

ARM templates at the subscription scope.

A. New-AzResource: This cmdlet is used to create or update an individual Azure resource,

not to deploy an ARM template that defines multiple resources or control structures.

B. New-AzResourceGroupDeployment: This cmdlet is used to deploy an ARM template to a

pre-existing or specified resource group. Since this template creates the resource group

itself, the deployment must occur at the subscription level.

C. New-AzTenantDeployment: This cmdlet is used for deploying ARM templates at the

tenant scope, which is for resources like management groups or Azure Active Directory

policies, not for creating resource groups and storage accounts in this manner.

Microsoft Learn: "Deploy resources with ARM templates and Azure PowerShell" - This page

describes different deployment cmdlets. New-AzDeployment is used for subscription,

management group, and tenant level deployments. New-AzResourceGroupDeployment is

for resource group deployments.

URL: https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/deploypowershell

Microsoft Learn: "Subscription deployments with ARM templates" - This page explicitly

states to use New-AzDeployment for subscription-level templates.

URL: https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/deploy-tosubscription

Microsoft PowerShell Documentation: New-AzDeployment

URL: https://learn.microsoft.com/en-us/powershell/module/az.resources/new-azdeployment

(States: "The New-AzDeployment cmdlet adds a deployment at the current subscription

scope.")

Microsoft PowerShell Documentation: New-AzResourceGroupDeployment

URL: https://learn.microsoft.com/en-us/powershell/module/az.resources/newazresourcegroupdeployment (States: "Deploys resources to a resource group.")

To automatically scale an Azure App Service plan based on a performance metric like CPU

usage, you must configure autoscale rules. This is achieved within the "Scale out (App

Service plan)" settings by selecting the custom autoscale option, which allows you to define

rules. A rule can be set to trigger a scale-out action (adding more instances) when the CPU

percentage exceeds a specified threshold, such as 80%. This ensures the application has

more resources to handle the increased load automatically.

A. Automatic in the Scale out method settings: While the goal is automatic scaling, the

specific configuration method in Azure for metric-based scaling is defined by rules. "Rules

Based" is the more precise term for this mechanism.

C. Premium P1 in the Scale up (App Service plan) settings: This is a "scale up" operation,

which changes the size and capabilities (CPU, memory) of the instances, not the number of

instances. It does not provide automatic scaling based on load.

D. Standard S1 in the Scale up (App Service plan) settings: This is a "scale up" setting. The

plan is already Standard, and this action does not configure automatic scaling based on

performance metrics.

E. Manual in the Scale out method settings: This requires an administrator to manually

change the instance count and is the opposite of the "automatic" scaling requirement.

Microsoft Azure Documentation: "Get started with autoscale in Azure". This document

explains that custom autoscale operates based on rules that you define. It states, "You can

configure autoscale rules that are based on metrics... For example, you can increase the

number of instances when CPU usage is above 80%."

URL: https://learn.microsoft.com/en-us/azure/azure-monitor/autoscale/autoscale-get-started

Microsoft Azure Documentation: "Scale instance count manually or automatically". This

guide details the process for App Services, showing that to scale based on a metric, you

must select "Custom autoscale" and "Add a rule".

URL: https://learn.microsoft.com/en-us/azure/app-service/manage-scale-up#scale-instancecount-manually-or-automatically

An Azure alert rule is created for a specific signal on a defined scope. Since there are four

distinct signals to be monitored (Ingress, Egress, Delete storage account, Restore blob

ranges), a minimum of four separate alert rules are required.

An action group is a reusable collection of notification p

and actions. To

determine the minimum number of action groups, we identify the unique sets of users to be

notified:

1. User1 and User3

2. User1 only

3. User1, User2, and User3

These three distinct notification requirements necessitate a minimum of three action

groups. The action group configured to notify User1 and User3 can be reused for both the

"Ingress" and "Restore blob ranges" alert rules.

References:

1. Microsoft Learn, Alert rules in Azure Monitor: This document states, "An alert rule

monitors your telemetry and captures a signal... The rule combines the resources to

be monitored, the signal or telemetry from the resource, and conditions." This

confirms that each unique signal requires its own rule.

o URL: https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alertsoverview#alert-rules

2. Microsoft Learn, Action groups: This documentation explains, "An action group is

a collection of notification preferences... You can use an action group with more than

one alert rule; this allows you to use the same notification methods whenever those

alerts are triggered." This supports the principle of creating reusable action groups

for unique sets of recipients.

o URL: https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/actiongroups

To meet the requirements, the Standard App Service plan is the most appropriate choice.

The Free, Shared, and Basic tiers do not support the required autoscale capability of up to

eight instances. While Premium and Isolated tiers also meet the technical requirements, the

Standard plan is the most cost-effective option that satisfies all conditions, thereby

minimizing costs.

For domain verification, a TXT record is used. Azure provides a unique Domain Verification

ID that must be added as a TXT record to your domain's DNS settings. This process proves

to Azure that you have ownership of the custom domain before it can be associated with the

App Service app. While a CNAME record is used to map a subdomain, the TXT record is a

primary method specifically for the verification step.

•

Azure App Service pricing tiers: The official Azure documentation details the

features available in each App Service plan. The "App Service pricing" page shows

that the Standard plan is the first tier to include autoscale capabilities up to 10

instances and support for custom domains.

o Source: Microsoft Azure Documentation

o URL: https://azure.microsoft.com/en-us/pricing/details/app-service/windows/

(Refer to the feature matrix comparing Free, Shared, Basic, Standard, and

Premium plans).

•

Custom domain verification: The official tutorial for mapping a custom domain to

an App Service app explicitly describes using a TXT record for domain ownership

verification.

o Source: Microsoft Azure Documentation, "Tutorial: Map an existing custom

DNS name to Azure App Service"

o URL: https://docs.microsoft.com/en-us/azure/app-service/app-service-webtutorial-custom-domain

o Specific Section: In the "Get a domain verification ID" and "Create the DNS

records" sections, the procedure outlines creating a TXT record (asuid.your-

subdomain) with the verification ID as its value.

The Azure Custom Script Extension is designed to download and execute scripts on Azure

virtual machines after they are provisioned. This is ideal for post-deployment configuration

tasks, such as installing software like NGINX. When deploying a virtual machine scale set

using an Azure Resource Manager (ARM) template, the Custom Script Extension can be

included in the template to ensure that NGINX is installed on all instances automatically.

A. the Publish-AzVMDscConfiguration cmdlet: This cmdlet is used to package and publish a

PowerShell Desired State Configuration (DSC) script, which is part of using Azure

Automation DSC or the DSC extension. While DSC can install software, the cmdlet itself is

a preparatory step, not the direct mechanism used within the ARM template for execution

on the VMs. The Custom Script Extension is more direct for this specific task.

B. Azure Application Insights: This is an Application Performance Management (APM)

service used for monitoring applications, not for installing software on virtual machines.

D. a Microsoft Endpoint Manager device configuration profile: Microsoft Endpoint Manager

(formerly Intune) is primarily for managing client devices and mobile endpoints. It's not the

standard tool for configuring server software on Azure VMs within a scale set during ARM

template deployment.

Azure Custom Script Extension:

Microsoft Learn: "Custom Script Extension for Windows." "The Custom Script Extension

downloads and executes scripts on Azure virtual machines. This extension is useful for post

deployment configuration, software installation, or any other configuration / management

task."

URL: https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/custom-scriptwindows

Microsoft Learn: "Tutorial: Install applications in Virtual Machine Scale Sets with an Azure

Resource Manager template." This tutorial demonstrates using the Custom Script Extension

to install a web server (IIS, but the principle applies to NGINX).

URL: https://learn.microsoft.com/en-us/azure/virtual-machine-scale-sets/tutorial-installapps-template (Section: "Use Custom Script Extension")

Azure Desired State Configuration (for option A context):

Microsoft Learn: "Introduction to Azure Desired State Configuration."

URL: https://learn.microsoft.com/en-us/azure/automation/dsc-overview

Azure Application Insights (for option B context):

Microsoft Learn: "What is Application Insights?"

URL: https://learn.microsoft.com/en-us/azure/azure-monitor/app/app-insights-overview

Microsoft Endpoint Manager (for option D context):

Microsoft Learn: "What is Microsoft Intune?" (Intune is part of Microsoft Endpoint Manager)

URL: https://learn.microsoft.com/en-us/mem/intune/fundamentals/what-is-intune

To manage VM configurations using Azure Automation State Configuration, you must follow this sequence:

1. Upload a configuration: First, you must import the PowerShell DSC configuration script (the logical definition of the desired state) into the Azure Automation account.
2. Compile a configuration: The uploaded script cannot be applied directly. It must be compiled into a MOF (Managed Object Format) file, known as a "Node Configuration," which the Local Configuration Manager (LCM) on the VM can understand and apply.
3. Check the compliance status: Once the configuration is applied to the nodes, you verify and manage ongoing consistency by checking the compliance reports. This tells you if the VM matches the desired state or has drifted.

Assign tags to the virtual machines: Tagging is a mechanism for organizing and

managing Azure resources. It is not a required functional step in the workflow of applying a

DSC configuration.

Create a management group: Management groups are used for enterprise-level

governance and policy management across multiple subscriptions. They are not directly

involved in the process of applying configurations to nodes within an Automation Account.

Microsoft Learn: Get started with Azure Automation State Configuration - Upload a configuration to Azure Automation. (Confirms uploading is the first step).

Section: "Import a configuration".

URL: https://learn.microsoft.com/en-us/azure/automation/automation-dsc-getting-started#import-a-configuration-into-azure-automation

Microsoft Learn: Get started with Azure Automation State Configuration - Compile a configuration. (Confirms compilation is the necessary processing step).

Section: "Compile a configuration into a node configuration".

URL: https://learn.microsoft.com/en-us/azure/automation/automation-dsc-getting-started#compile-a-configuration-into-a-node-configuration

Microsoft Learn: Azure Automation State Configuration overview - View reports. (Confirms checking compliance is the management/verification step).

Section: "View reports".

URL: https://learn.microsoft.com/en-us/azure/automation/automation-dsc-overview#view-reports

To configure Azure File Sync on an on-premises server (Server1), you must follow this specific sequence:

1. Install the Azure File Sync agent: This is the primary prerequisite. The agent enables the Windows Server to communicate with the Storage Sync Service in Azure.
2. Register Server1: After the agent installation, the server must be registered with the Storage Sync Service. This establishes a trust relationship between the on-premises server and the Azure resource.
3. Add a server endpoint: Once registered, you add a server endpoint to a Sync Group. This defines the specific path (folder/volume) on the server that will synchronize with the Azure File Share.

Create an Azure on-premises data gateway: This component is used for other services

like Power BI and Logic Apps to access on-premises data; Azure File Sync uses its own

dedicated agent.

Create a Recovery Services vault: This is a component of Azure Backup and Azure Site

Recovery and is not a direct step in the Azure File Sync deployment process.

Install the DFS Replication server role on Server1: Azure File Sync is a distinct

technology from DFS Replication and does not require the DFS-R server role to be installed

to function.

Microsoft Learn. "Deploy Azure File Sync - Install the Azure File Sync agent." Azure Storage, Access Date: November 28, 2025.

Quote: "The Azure File Sync agent is a downloadable package that enables Windows Server to be synced with an Azure file share."

URL: https://learn.microsoft.com/en-us/azure/storage/file-sync/file-sync-deployment-guide?tabs=azure-portal%2Cproactive-portal#install-the-azure-file-sync-agent

Microsoft Learn. "Deploy Azure File Sync - Register Windows Server with Storage Sync Service." Azure Storage.

Quote: "Registering your Windows Server with a Storage Sync Service establishes a trust relationship between your server (or cluster) and the Storage Sync Service."

URL: https://learn.microsoft.com/en-us/azure/storage/file-sync/file-sync-deployment-guide?tabs=azure-portal%2Cproactive-portal#register-windows-server-with-storage-sync-service

Microsoft Learn. "Deploy Azure File Sync - Create a server endpoint." Azure Storage.

Quote: "A server endpoint represents a specific location on a registered server, such as a folder on a server volume."

URL: https://learn.microsoft.com/en-us/azure/storage/file-sync/file-sync-deployment-guide?tabs=azure-portal%2Cproactive-portal#create-a-server-endpoint

While the correct Azure CLI command is upgrade, it is not offered as an option.

Given the choices, updates is the most plausible selection as it conceptually aligns

with the task of performing an upgrade. The core of the question lies in configuring

the upgrade process. The --max-surge parameter is used to specify the number of

additional buffer nodes created during an upgrade to ensure application availability.

Setting --max-surge 2 directly fulfills the requirement to "Deploy two new nodes to

perform the upgrade," allowing for a controlled, rolling update while managing costs.

Note: The official documentation will refer to the correct command upgrade, which

substantiates the use of the --max-surge parameter as described in the scenario.

1. Azure CLI Documentation for az aks nodepool upgrade: This official

source confirms that the --max-surge parameter is the correct mechanism for

controlling the number of buffer nodes during a node pool upgrade.

o Source: Microsoft Learn, Azure Command-Line Interface (CLI)

Documentation.

o URL: https://learn.microsoft.com/enus/cli/azure/aks/nodepool?view=azure-cli-latest#az-aks-nodepool-

upgrade

o Specific Section: Parameter Set, --max-surge.

2. AKS Cluster and Nodepool Upgrade Concepts: This document explains

the surge upgrade strategy. It clarifies that --max-surge is the setting that

controls how many extra nodes are provisioned to facilitate the upgrade

process, which is central to the question's requirements.

o Source: Microsoft Learn, Azure Kubernetes Service (AKS)

Documentation.

o URL: https://learn.microsoft.com/en-us/azure/aks/upgradecluster#customize-node-surge-upgrade

o Specific Section: "Customize node surge upgrade".