When using Azure Container Instances (ACI) that require persistent storage, the recommended and supported storage solution is Azure Files. Azure Files provides a fully managed Server Message Block (SMB) or Network File System (NFS) file share that can be mounted by container instances at runtime.
According to Microsoft Azure Administrator documentation, Azure Files is designed for workloads that require shared, durable storage accessible by multiple compute nodes, including containers. It supports read
/write persistence and maintains data durability across restarts of containers.
In this question, since the Docker image contains a Microsoft SQL Server instance, persistent and shared storage is necessary to store the database files (.mdf, .ldf). Blob, Queue, or Table storage cannot provide this functionality because:
Blob storage is for object storage (no file system mount capability).
Queue storage is for message-based communication.
Table storage is for NoSQL key-value structured data.
Azure Files allows containerized SQL Server instances to store their database files securely and persistently between container restarts or failures.

This question focuses on creating guest user accounts (B2B users) in Azure Active Directory (Microsoft Entra ID) using bulk operations. The requirement is to import 500 external users from a CSV file and invite them as guest users into the tenant contoso.com.
# Understanding the Goal
You must create guest accounts (B2B collaboration users) - not regular internal users.
Guest accounts in Azure AD have:
UserType = Guest
Their identity originates from an external organization (using their own email domain).
They are invited via B2B invitations.
The key operation used to accomplish this is Bulk invite users, not Bulk create users.
# Why "Bulk Create Users" Does NOT Meet the Goal
The Bulk create users operation in the Azure portal is used for adding internal users to the directory (i.e., users who belong to the same Azure AD tenant).
It creates standard member accounts, not guest accounts.
It cannot send invitations to external users or create guest-type identities (UserType = Guest).
In contrast:
The Bulk invite users operation imports external user data from a CSV file and automatically sends invitations to the listed email addresses.
It creates user objects with UserType = Guest in Azure AD, meeting the scenario's goal.
Hence, the Bulk create user method fails to create guest users and does not meet the goal.
# Correct Method (for Reference)
From Microsoft Entra ID # Users # Bulk operations # Bulk invite, you can:
Download a CSV template.
Fill in external users' names and email addresses.
Upload the CSV file.
Azure AD then creates guest user accounts and sends invitations to join the directory.
This is the only correct approach for mass-adding external (guest) users.
# Verified Documentation Extract (Microsoft Learn)
"The Bulk invite operation in Azure AD allows administrators to invite multiple external users at once by uploading a CSV file. Bulk create operation, on the other hand, is for adding internal users to your organization's directory." (Source: Microsoft Learn - Invite external users in bulk to Microsoft Entra ID, AZ-104 Study Guide)
# Final Verified Answer:
B). No
Using the Bulk create users operation adds internal member accounts, not external guest accounts. To create guest accounts, the correct action is to use the Bulk invite users operation in Azure AD.

When a public Azure DNS zone is created, Azure automatically assigns a set of authoritative name servers (NS records) to the zone. However, simply creating the DNS zone in Azure does not make it resolvable from the internet. For external resolution to work, the domain registrar must delegate authority to Azure DNS.
Microsoft Azure documentation clearly states that to make DNS records resolvable publicly, you must update the domain registrar's NS records to point to the Azure-assigned name servers. This action establishes Azure DNS as the authoritative DNS provider for the domain.
Creating NS or SOA records within the Azure DNS zone itself does not affect external resolution unless the registrar delegation is completed. The SOA record is automatically created and managed by Azure DNS and must not be modified at the registrar.

Explanation:

According to the Microsoft Azure Administrator (AZ-104) Study Guide and Azure Role-Based Access Control (RBAC) documentation, permissions to link an Azure Private DNS zone to a virtual network require access to both the virtual network resource and the DNS zone resource.
The process of linking a DNS zone to a virtual network establishes name resolution for the resources within that VNet through the Private DNS zone. To perform this operation, the user must have:
* "Microsoft.Network/virtualNetworks/*" permissions (to modify and manage VNet settings).
* "Microsoft.Network/privateDnsZones/*" permissions (to manage DNS zone links).
These permissions are granted by two built-in roles:
* Network Contributor - Allows full management of the network resources like virtual networks, subnets, and network interfaces but does not allow access to manage DNS zones.
* Private DNS Zone Contributor - Allows management of private DNS zones and their link configurations.
Therefore, to grant User1 the ability to link Zone1.com (Private DNS Zone) to VNet1, the correct approach is to assign both roles with the least privilege principle, scoped specifically to the required resources:
* Network Contributor on VNet1
* Private DNS Zone Contributor on zone1.com
Assigning the permissions at the resource level (and not at the resource group or subscription level) ensures compliance with the principle of least privilege, a core requirement of Azure governance.
This setup enables User1 to perform the exact operation (linking the Private DNS Zone to the VNet) while preventing unnecessary access to unrelated resources.
Final Verified Answer:
# Roles: Network Contributor and Private DNS Zone Contributor only
# Resources: VNet1 and zone1.com only
Topic 1, A. Datum Corporation
Overview
A). Datum Corporation is a consulting firm that has a main office in Montreal and branch offices in Seattle and New York.
Azure Environment
A). Datum has an Azure subscription that contains three resource groups named RG1. RG2, and RG3. The subscription contains the storage accounts shown in the following table.

The subscription .contains the virtual machines shown in the following table.

The subscription has an Azure container registry that contains the images shown in the following table.

The subscription contains the resources shown in the following table.

The subscription contains an Azure key vault named Vaultl.
Vault! contains the certificates shown in the following table.


Vaultl contains the keys shown in the following table.
Microsoft Entra Environment
A). Datum has a Microsoft Entra tenant named adatum.com that is linked to the Azure subscription and contains the users shown in the following table.
The lenant contains the groups shown in the following table.

The adatum.com tenant has a custom security attribute named Attribute1.
Planned Changes
A). Datum plans to implement the following changes:
* Configure a data collection rule {DCR) named DCR1 to collect only system events that have an event ID of
4648 from VM2 and VM4.
* In storage1, create a new container named cont2 that has the following access policies:
o Three stored access policies named Stored 1, Stored2, and Stored3 o A legal hold for immutable blob storage
* Whenever possible, use directories to organize storage account content.
* Grant User1 the permissions required to link Zone1 to VNet1.
* Assign Attribute1 to supported adatum.com resources.
* In storage2, create an encryption scope named Scope " 1.
* Deploy new containers by using Image1 or Image2.
Technical Requirements
A). Datum must meet the following technical requirements:
* UseTLSforWebApp1.
* Follow the principle of least privilege.
* Grant permissions at the required scope only.
* Ensure that Scope1 is used to encrypt storage services.
* Use Azure Backup to back up cont1 and share1 as frequently as possible.
* Whenever possible, use Azure Disk Encryption and a key encryption key (KEK) to encrypt the virtual machines.