# AZ-104 Challenge Labs

For more challenge lab please visit [Skillable](https://challenge-labs.learnondemand.net/Organization/CourseCatalog/2743?run=1#%7B%22pageIndex%22%3A0%2C%22pageSize%22%3A20%2C%22filter%22%3A%22%22%2C%22matchType%22%3A0%2C%22subscriptionProfileIds%22%3A%5B%5D%2C%22tagInputIds%22%3A%5B%5D%2C%22tagsJson%22%3Anull%2C%22bookmarks%22%3Anull%2C%22StatusFilter%22%3A0%2C%22ratingFilter%22%3A0%2C%22view%22%3A%22Grid%22%2C%22groupedTags%22%3Anull%7D) website.

## Governance and Compliance

### Assign built-in roles and verify permissions

```powershell
# Define the variables
$userPrincipalName = "dev-test@example.com"
$resourceGroupName = "test-rg"
$roles = @(
    "Storage Account Contributor"
    "Virtual Machine Contributor"
    "Network Contributor"
)

# Loop through the roles and assign them to the user
foreach ($roleName in $roles) {
    New-AzRoleAssignment -RoleDefinitionName $roleName -SignInName $userPrincipalName -ResourceGroupName $resourceGroupName
}
```

* Use role-based access control (RBAC) to allow the [`dev-test@example.com`](mailto:dev-test@example.com) developer account to manage certain resources in the `test-rg` resource group by adding the following role assignments: Storage Account Contributor, Virtual Machine Contributor, Network Contributor.
    

### Create a virtual machine as a developer

* Identify the operations associated with virtual machines by using the Get-AzProviderOperation cmdlet.
    

> Note the operations for **read**, **start**, and **deallocate**.

> You can use the operations associated with an Azure resource as actions when you create an Azure role-based access control (RBAC) custom role.

> Want to learn more? Review the documentation on the [Get-AzProviderOperation](https://docs.microsoft.com/en-us/powershell/module/az.resources/get-azprovideroperation?view=azps-3.8.0) cmdlet.

```powershell
# Get all operations for virtual machines (using a wildcard)
$vmOperations = Get-AzProviderOperation "Microsoft.Compute/virtualMachines/*"

# Identify read, start, and deallocate operations
$readOperation = $vmOperations | Where-Object { $_.Operation -match "read" }
$startOperation = $vmOperations | Where-Object { $_.Operation -match "start/action" }
$deallocateOperation = $vmOperations | Where-Object { $_.Operation -match "deallocate/action" }

# Output the relevant operations
Write-Host "Read Operation:"
$readOperation | Format-Table Operation, Description # Corrected line

Write-Host "Start Operation:"
$startOperation | Format-Table Operation, Description # Corrected line

Write-Host "Deallocate Operation:"
$deallocateOperation | Format-Table Operation, Description # Corrected line
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741206553213/5e3aafd9-1027-4c25-bc9a-fbdaec294cc1.png align="center")

* Retrieve the role definition for the Virtual Machine Contributor role and then output it to $home\\clouddrive\\VMOperatorRole.json by using the Get-AzRoleDefinition and the ConvertTo-Json cmdlets.
    

> You can use Azure role-based access control (RBAC) role assignments to grant access to resources at a specific scope—subscription, resource group, resource—by assigning a role to a user, group, service principal, or managed identity. There are two types of roles that you can use: built-in and custom. You can create a custom role by using the Azure portal, Azure PowerShell®, Azure command-line interface (CLI) 2.0, and the REST API.

> Want to learn more? Review the following documentation:
> 
> * [Get-AzRoleDefinition](https://docs.microsoft.com/en-us/powershell/module/az.resources/get-azroledefinition?view=azps-3.8.0)
>     
> * [ConvertTo-Json](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/convertto-json?view=powershell-7)
>     
> * [Custom roles](https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles)
>     

```powershell
# Get the role definition for the Virtual Machine Contributor role
$roleDefinition = Get-AzRoleDefinition -Name "Virtual Machine Contributor"

# Convert the role definition to JSON format
$jsonRoleDefinition = $roleDefinition | ConvertTo-Json

# Output the JSON to the specified file
$jsonRoleDefinition | Out-File -FilePath $home\clouddrive\VMOperatorRole.json
```

* Open the VMOperatorRole.json file in the Azure Cloud Shell code edi[tor by using the code command in](https://docs.microsoft.com/en-us/azure/cloud-shell/using-cloud-shell-editor) the $home\\clouddrive folder.
    

> If prompted, switch to Cloud Shell classic mode, and then run the comm[ands again.](https://docs.microsoft.com/en-us/azure/cloud-shell/using-cloud-shell-editor)

> [You can edit t](https://docs.microsoft.com/en-us/azure/cloud-shell/using-cloud-shell-editor)he definition of a built-in role by using the Azure Clou[d Shell code editor, and then](https://docs.microsoft.com/en-us/azure/cloud-shell/using-cloud-shell-editor) you can save the definition as a new custom role.

> Want to learn more? Review the documentation on [Azure Cloud Shell code](https://docs.microsoft.com/en-us/azure/cloud-shell/using-cloud-shell-editor) [editor.](https://docs.microsoft.com/en-us/azure/cloud-shell/using-cloud-shell-editor)

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741207524033/300ca3ad-1d41-47bd-9e47-4c95f7a2010f.png align="center")

[or](https://docs.microsoft.com/en-us/azure/cloud-shell/using-cloud-shell-editor)

[code ~/cloudd](https://docs.microsoft.com/en-us/azure/cloud-shell/using-cloud-shell-editor)rive/VMOperatorRole.jsoncode ~/clouddrive/VMOperatorRole.json

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741208499031/401232af-4a6d-461a-ae7e-0415b161d17c.png align="center")

You can create a new custom role in Azure using the New-AzRoleDefinition cmdlet and your VMOperatorRole.json file. Run the following command in **Azure PowerShell**:

```powershell
New-AzRoleDefinition -InputFile "home\clouddrive\VMOperatorRole.json"
```

---

## Configure a Network Security Group in a Virtual Network

In this, you will configure a network security to allow secure (SSH) connections to a virtual machine. First, will create application security group, followed by creation of a network security. Next you will associate the security group with a subnet in the virtual network, and then you associate the application security group with the network interface on the virtual.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741284244466/bf6d7c45-1f9f-4ccd-bd20-bc41b32c86bd.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741284205262/675354dd-09fd-4f4b-abd7-c92931ab92b3.png align="center")

Finally, you will add an inbound security rule, and then you will verify that you can connect to the linux virtual machine in the subnet by using SSH.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741285994349/2d5d9f20-f660-401a-bef6-000be943f783.png align="center")

Connect to the virtual machine at azureadmin@74.235.217.96 by using an SSH connection

first try before creating the rule was time out and second one after adding the rule to the nsg:

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741286200660/3b1fe117-8007-43b5-918a-34d842ea065b.png align="center")

---

## Configure Route Tables in a Virtual Network

**Configure Front End:**

* Create a Route table named app-frontend-rt by using the **RG1lod49100900(909 here)** resource group and the **East US** region, and then disable gateway route propagation.
    
* ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741298804009/7e62ac88-a928-45e6-a314-50dd943ce8f4.png align="center")
    
* Add a route named to-backend to the **app-frontend-rt** route table, and then configure the route by using an address prefix of 10.1.1.0/24 and a **Virtual appliance** next hop address of 10.1.255.4.
    
* ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741299019914/c2260c83-8ba8-433c-a658-5ef79ad39dc4.png align="left")
    
* Associate the **app-frontend-rt** route table to the **frontend** subnet in the **app-vnet** virtual network.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741301758217/b9f2b4cb-035f-4513-9b1c-33c052510d7e.png align="center")

You can associate a route to a subnet by using the Azure portal, the *Set-AzVirtualNetworkSubnetConfig* and *Set-AzVirtualNetwork* cmdlets, or the *az network route-table route* command.

**Configure back-end:**

* Create a Route table named app-backend-rt that uses the **RG1lod49100900** resource group and the **East US** region, and then disable gateway route propagation. (process same as above)
    
* Add a route named “to-frontend” to the **app-backend-rt** route table, and then configure the route by using an address prefix of 10.1.0.0/24 and a **Virtual appliance** next hop address of 10.1.255.4.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741300155723/74c4b47b-e72e-4300-9fc6-1849ad0a7ee9.png align="center")

* Associate the **app-backend-rt** route table to the **backend** subnet in the **app-vnet** virtual network.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741300306323/19ec02a7-0ce6-449c-9610-3bda826587ad.png align="center")

* Open an Azure Cloud Shell **Bash** session without mounting a storage account.
    
* Create a secure shell (SSH) connection to VM3(Linux Machine) by using azureuser@20.172.210.22, and then when prompted, enter AzurePwd49100909 as the password.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741300848034/d6f202e0-4418-4cd0-9598-a5684a1be722.png align="center")

* Enable IP forwarding by using the sudo user and the sysctl command, and then exit the SSH connection.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741300923758/f016fe4a-2bd0-4ad3-94c7-986ac4cddfdd.png align="center")

* In Cloud Shell, create an ssh connection to VM2 by using azureuser@4.236.142.95, and then when prompted, enter AzurePwd49100909 as the password.
    
* In the SSH session, update the virtual machine by using sudo and apt-get.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741302499478/d42a35c5-53ef-4982-9a73-2742852c8571.png align="center")

> Ensure that you have updated the Linux virtual machine before moving on to the next task.

* Install the traceroute tool by using sudo and apt.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741302568982/384d4177-2594-4654-ba6d-a9fa6c992084.png align="center")

* Verify that traffic sent to VM1 is routed through the virtual appliance **VM3** by using the traceroute tool, and then exit the SSH connection.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741302804227/0d744524-f961-4dea-9dcc-8d74dcea55d6.png align="center")

---

## Configure Global Virtual Network Peering

In this challenge, you will configure a virtual network peering between the virtual networks for two applications hosted in different Azure regions.

First, you will review existing Azure resources, and then you will verify that you are unable to add virtual network peerings between the existing virtual networks.

Next, you will remove overlapping address spaces in the virtual network configuration. Finally, you will configure global virtual network peering between the two virtual networks.

VM1 Public IP: 172.206.208.169

vNet1 address space: 10.1.0.0/16

vNet2 address space: 10.1.0.0/16

> The address spaces of virtual networks that you intend to connect should not overlap. You will correct this in an upcoming task.

* Attempt to add a virtual network peering named VNET1-to-VNET2 to the **VNET2** virtual network.
    
    * A successful virtual network peering would allow traffic to flow in both directions between the VNET1 and VNET2 virtual networks.
        
    * You can use a virtual network peering to connect virtual networks together. For connectivity purposes, Azure will view the connected networks as if they are one network, and traffic will be routed between the peered virtual networks across the Microsoft backbone rather than through a gateway. For this reason, traffic between peered virtual networks will never traverse the public internet.
        
    * You can choose between two types of peering:
        
        * Virtual network peering connects virtual networks in the same region.
            
        * Global virtual network peering connects virtual networks in different regions.
            
        
        You can use user-defined routes to implement service chaining by configuring a virtual machine in the peered virtual network as the next hop IP address.
        
        You can also configure a gateway in a peered virtual network as a transit point to an on-premises network. This is referred to as *gateway transit*.
        
* ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741374405488/e8c574a5-9c2f-4bc5-9719-7852503f1fcf.png align="center")
    
    Add an address space of 10.2.0.0/16 to **VNET2**.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741368755091/04d835d2-6188-46d9-8431-872100657c60.png align="center")

* Add a subnet named subnet2 to **VNET2** by using a subnet address range of 10.2.0.0/24 .
    

> When you design the address ranges of your subnets, remember that the first three IP addresses in each subnet are reserved by Azure for internal use.

* Associate **VM2-nic** to **subnet2** in **VNET2**.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741369761671/2179e2ca-0e1c-4b95-bc35-dc3d77d7c4c6.png align="center")

* Delete **subnet1** in **VNET2**.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741369936170/bbc5719a-348f-4f03-8499-ffdc0493a43f.png align="center")

* Delete the **10.1.0.0/16** address space in **VNET2**.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741369996093/f6747f76-7b0c-4c79-b8ca-f29a546cf167.png align="center")

* Add a virtual network peering to **VNET2** that uses a remote virtual network connection named VNET1-to-VNET2 and a local virtual network connection named VNET2-to-VNET1, and that is configured to **Allow 'VNET1' to receive forwarded traffic from 'VNET2'** in remote settings and **Allow 'VNET2' to receive forwarded traffic from 'VNET1'** in local settings.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741374609318/c098eccd-080a-4427-8fb3-1184a70edcce.png align="center")

* Verify that the peering status of **VNET1-to-VNET2** is **Connected**.
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741374922347/506f3973-13f3-4253-b91e-d46f4796ea6e.png align="center")
    
    * Verify that VNET1 and VNET2 are connected by using the ping command to 10.2.0.4.
        
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741375013711/1c3906f9-003c-42fc-b93b-527945299ff5.png align="center")
    

---

## Enable High Availability by Using Availability Sets

In this Challenge Lab, you will configure high availability by using availability sets. First, you will create an availability set and a virtual network. Next, you will deploy two Azure virtual machines to the availability set. Finally, you will configure load balancing.

1. ### **Creating an Availability Set**
    

* Availability sets help distribute **virtual machines (VMs)** across multiple **fault domains** (for power and hardware failure protection) and **update domains** (to stagger reboots during maintenance).
    
* You first create an **Availability Set** in Azure.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741376500233/9536f6c1-0778-4073-8b0d-3615e83bb664.png align="center")

2. **Creting a Virtual Network**
    

* A **virtual network (VNet)** named **“AVSet-Vnet”** is created.
    
* This allows communication between the virtual machines deployed within it.
    

3. **Deploying Two Virtual Machines**
    

* Two Azure **Virtual Machines (VMs)** are created and assigned to the **Availability Set**.
    
* **Each VM is placed in a different fault and update domain** to ensure redundancy:
    
* **Fault Domains**: Protect against hardware failures (e.g., racks in different power circuits).
    
* **Update Domains**: Ensure that updates and reboots happen in phases without taking down all VMs at once.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741710450806/61a596f7-6b78-4e2e-9f0f-a650d285cab7.png align="center")

After you deploy the virtual machines, each one should be in a **separate fault and update domain** for high availability.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741710873663/e9fef6cb-ae1f-4bab-9c8e-890fe23f463f.png align="center")

4. **Creating an Azure Load Balancer**
    

* An **Azure Load Balancer** is deployed to distribute traffic evenly across the VMs.
    
* This ensures no single VM handles all requests, improving performance and availability.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741711316719/c9228351-2431-4bc8-9d0c-2c0014802fd8.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741711075352/07d18489-5715-4a4a-a021-0b8c49d969ce.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741711338617/0f018a71-7a1c-4c7e-a3ba-f28a9312c844.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741711403446/d8cdb1c0-1d0a-47dd-ae5c-8766612ef67a.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741711422289/9f73fd7c-5a44-4d9c-9175-13ed4f202201.png align="center")

5. **Adding a Health Probe**
    

* A **Health Probe** is configured to check the health of VMs.
    
* The probe ensures that only healthy VMs receive traffic, rerouting requests away from failed or unhealthy instances.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741711575732/e5b39204-3f6e-4ab2-a8f7-49dd2fb93584.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741711647577/a07d64dd-5227-48d8-a95f-4561b5d30fbb.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741711637639/956d5a9b-0186-442b-91fa-d9936d3e0362.png align="center")

6. **Adding a Load Balancing Rule**
    

* A **Load Balancing Rule** is created to define how traffic is distributed across the VMs.
    
* It typically specifies:
    
    * **Frontend IP**
        
    * **Backend pool (VMs in the availability set)**
        
    * **Port rules (e.g., HTTP on port 80)**
        
    * **Health probe association**
        

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741711689192/748d90cb-910a-4dc6-a1a8-4bf4f0a0ae77.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741711756044/685bc242-75c1-42cf-9395-e25a8ad402ae.png align="center")

You have successfully completed the following tasks:

* Created an **availability set** to ensure high availability.
    
* Deployed **two Azure virtual machines** within the availability set.
    
* Integrated an **Azure load balancer** with the availability set.
    
* Configured a **health probe** for the load balancer.
    
* Defined a **load balancing rule** to manage traffic distribution.
    

**Outcome**

By following these steps, you achieve:

* **Improved high availability**: No single failure (hardware, update, or maintenance) brings down the service.
    
* **Load distribution**: Requests are balanced across multiple VMs.
    
* **Automated failover**: If one VM fails, traffic is rerouted automatically.
    

---

# Configure Blob Storage with Public Access

In this challenge, you will create an Azure storage account with a public container, upload files to the account, and test public access to the account.

1. Create a storage account by using standard performance, locally redundent storage and on advanced page allow enabling anounymous access on individual containers.
    
2. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741799353398/7e70403e-5156-4bc4-873c-1b0b969f7e96.png align="center")
    
    Add a blob container named public on the storage account and set the public access level to Blob (in data storage select containers and add it there)
    
3. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741799714804/3e7f7e99-c869-4926-9511-238ee021c223.png align="center")
    
    you can find the access key in security and networking
    
4. Upload any image file (for example, .JPG, .PNG, or .GIF) on your computer to the **public** container, in the **sa49292475** storage account, as a **64 KiB** block blob by using the **Hot** access tier.
    
5. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741800245891/f447291b-64e1-4ec4-95ae-61ef77e5c06f.png align="center")
    
    Add a Blob index tag on the uploaded blob file by using the Key/Value pair of source / Portal. Click on the file and on the blob page , scroll down to Blob index tag
    
6. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741800998182/eb0a47ca-9e0a-4b0d-94b3-7dc25ec5c76d.png align="center")
    
    In the same page you can see the URL property of the blob file here:
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741801170357/662c4993-e99a-4d17-8d85-a2f520505af6.png align="center")

7. Upload another jpg with 64KiB block blob using Cool access tier and add a Blob index tag on the uploaded blob file by using the Key/Value pair of source / Archive
    

> Note that the list of blob files is sorted by file name alphabetically not by creation time.

8. Open the Web App home page from the **wa49292475** app service blade in the portal, and then select the **Test Blob Containers** link to open the File Test page.
    
    * On the Azure portal home page, select **All resources**, and then select the **wa49292475** App Service.
        
    * On the wa49292475 Overview page, in default domain, select the [**wa49292475.azurewebsites.net**](http://wa49292475.azurewebsites.net) link to open the home page.
        

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741802090756/3952580f-2124-485a-92da-ba1270654608.png align="center")

9. On the home page, select the **Test Blob Containers** link to open the File Test page.
    
    ![Web app home page](https://labondemand.blob.core.windows.net/content/lab180905/instructions232778/8buut21c.jpg align="left")
    
10. The File Test page should be displayed.
    

![The File Test page](https://labondemand.blob.core.windows.net/content/lab180905/instructions232778/zpr624bz.jpg align="left")

11. put the storage account name and key and click on test then the File Test page should be displayed after the test.
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741802651839/f40c9deb-1668-447c-be38-d6d91b1db03d.png align="center")
    

The Test Status should be set to 1 to show success.

You have provided the storage account name and the access key to the web app so it has *full access* to the storage account and is able to list the blob files in the container.

* On the File Test page, open the blob files by using the links provided. You should see your image files open in the browser.
    

> When you open the blob files by using the links provided, you are then accessing the files by using *anonymous read* operations outside of the application. This shows the *blob public access level* in action.

---

# Configure Blob Storage with Private Access

In this Challenge Lab, you will configure storage for various binary large object (blob) files used by a web app. First, you will create a storage account that has a private blob container, and then you will upload blob files to the container. Next, you will generate a shared access signature (SAS), and then you will configure application settings in a web app. Finally, you will test the configuration using a test page provided with the web app.

1. Create a storage account with standard performance and LRS redundency setting
    
2. add a blob container with private access level
    

* ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741807282011/4d58ec7c-d4f5-4c43-9277-85267171a893.png align="center")
    

> *Public access level* set to *Private* (the default) means that blobs within the container cannot be read by anonymous request. Permissions must be granted either through a Shared Access Signature (SAS) key or through Role-Based Access Control (RBAC).

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741807486816/0b5d7f2d-144c-4350-b16e-c61e57ba65d5.png align="center")

3. Upload an image with 64 KiB block and Hot access tier with blob index of source/private files
    

> Bob index tags can be set when a file is uploaded or afterward. A tag consists of a simple key value pair, and it can be retrieved by applications, by using Azure Cloud Shell, or by using command line (CLI) tools.

4. Upload a second image with 256 KiB block and Cool access tier with blob index of source/private files
    
5. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741808072579/332d99a4-c672-4726-b075-766454856eda.png align="center")
    
    go to web app and add these settings on environment variable, storage name and key:
    
6. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741808419488/59468a59-cab6-4323-80ed-282c90dc1fdf.png align="center")
    
    Add the key:
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741808646187/8be39efc-2b8b-4341-8e4d-61d58a700549.png align="center")
    

7\. Open the Web App home page from the **wa49297340** blade in the portal, ensure that the Status is **Running**, and then select the **Test Blob Containers** link to open the File Test page.

![Web app home page](https://labondemand.blob.core.windows.net/content/lab180906/instructions232779/ue603mx3.jpg align="left")

8. Since its not public wee should get an error message:
    
9. ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741808880113/084eaede-b8cd-4601-ad09-65194393f7e7.png align="center")
    
10. On the File Test page, locate the message: *These are the files in the private container with a SAS. These links should return files.*
    
11. Open the blob files by using the links provided—you should see your image files open in the browser.
    

---

# Can You Provision Public and Private Blob Storage for a Web App?

In this Challenge Lab, you will configure storage for various files used by a web app. First, you will create a storage account that has public and private blob containers, and then you will upload files to both containers. Next, you will generate a shared access signature for the private container, and then you will configure application settings in a web app. Finally, you will test the configuration using a test page provided by the web app.

1. Create a storage account with standard performance and LRS setting and enable the anonymous access on advanced tab.
    
2. Add a blob container with public access set to blob
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741819119166/e3a12d77-6f40-408e-aabe-0c490227fcd5.png align="center")

3. Add another one with public access set to private:
    
4. Keep record of key1 of storage account access key
    
5. Upload an image to public container as a 256 KiB block blob using Hot access tier (Key index source /Portal)
    
6. Upload the second image to private container as a 256 KiB block blob using Cool access tier
    
7. Generate a SAS token for the **private** container that allows **read** access for 8 hours and keep the token value
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741823226244/78ae5dcd-2f4c-4c62-87ab-a835f36c3d71.png align="center")
    
8. Add these three applicaion settings to the web app
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741823623076/7bcb293b-2777-4e51-ba4d-11822980db5a.png align="center")

9. on the web app file test page select test: (test status should be set to 3 to show success)The first and third links should return files. The second link should fail.
    

![The File Test page after test](https://labondemand.blob.core.windows.net/content/lab180907/instructions232780/rsivn5do.jpg align="left")

---

# Create Linux VM in an Availability Set

In this challenge, you will enhance the redundancy of a front-end server tier to ensure continuous application availability during update reboots and potential failures of power sources or network switches. You will begin by creating an availability set, followed by generating an SSH key pair. Finally, you will deploy two Linux virtual machines within the availability set to maintain resilience and uptime.Create a managed availability set named app-frontend-avset in the **rg1lod49333628** resource group by using 2 fault domains and 5 update domains.

1. Create a managed availability set named app-frontend-avset in the **rg1lod49347139** resource group by using 2 fault domains and 5 update domains (Use managed disk)
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741883867720/1d087f27-a219-43d8-b07e-893458ec408e.png align="center")

2. Create an SSH key pair that uses the rsa algorithm, a key size of 4096 bits, the default file path, and no passphrase by using the ssh-keygen command
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741916375178/0b269e49-646b-4959-952f-1a2b74e63555.png align="center")

> You can create an SSH key pair by using the *ssh-keygen* command, and then you can use the key pair when you create a Linux virtual machine in Azure.

3. Run the following command to display the generated RSA public key:
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741916501804/ce166635-9bda-411d-addf-3d86edf258c4.png align="center")

4. Create an Azure virtual machine by using the values in the following table.
    

| **Property** | **Value** |
| --- | --- |
| Resource group | **rg1lod49347139** |
| Name | app-frontend-vm1 |
| Availability options | **Availability set** |
| Availability set | **app-frontend-avset** |
| Image | **Ubuntu Server *latest version* LTS - Gen2** |
| Size | DS1\_v2 |
| SSH public key source | **Use existing public key** |
| SSH public key | (Copy the key from your text editor.) |
| Boot diagnostics | **Disable** |

5. Create a second Azure virtual machine by using the values in the following table. For any property that is not specified, use the default value.
    

| **Property** | **Value** |
| --- | --- |
| Resource group | **rg1lod49347139** |
| Name | app-frontend-vm2 |
| Availability options | **Availability set** |
| Availability set | **app-frontend-avset** |
| Image | **Ubuntu Server *latest version* LTS - Gen2** |
| Size | DS1\_v2 |
| SSH public key source | **Use existing public key** |
| SSH public key | for e.g. ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC3pZqVtok84a/Riu83jP4OQwc+1gZMHHvyYf/SeA/JlJeF4RhpKhCgFlN+EGCf99dgvNzcLrn+0Gmga28l354Q124hykCOTZjBbD2J/M0YeS+nciNHkcWjviw419t55ruSF5gpCILiUaRtwYBYsz1y3ee3DRxO4ekA6dhbKLOJ9DuZUyORlqq2quSR4uB0MDr8M1rdF2tpt2oDQnHtabcqy3M4FN6z8B+7GIJba99Vheztc/QEIqW7k9U/JOF6fC80NFvhuihHBxvVRkOJq8ZX+HlvXG45akYrKCyecZfgKySuVZ4FAtdDf0o5QeS/HuLo/tJSSgJTiAVvhJqwwNckGqAR74c0tmjcXFZksTpQoyvzVPEvsS07hPKr2SAXHPXQUGdU1M/vuskJv2pJ2tJ0q2yxL/gaqABW49o7ncxugSK49GRd2ZDEFutdXwCTgh5Y2Rqbk5TN9pGtL7WRznywmKKn9MpdmkFNZV6a9n7/2sQJf7Xk5nCla+W2Hm/3MhInkPKRMq1h9jDn0rMzU1yQUzqDb5+y3+0dzVBgzoCC5HKHsIt1+EcxaXkwgkM20yY4/FCInc+W/0foReakalpe/gRkZAmNasymSyIdbV1kzHlK+NofBe8fbD86jch2RCZEJdVRZIbtlrIAQLFExK4q79a4qkwQH8sjTX81vxAMsw== user1-49347139@SandboxHost-638775051176503819 |
| Boot diagnostics | **Disable** |

6. Verify that **app-frontend-vm1** and **app-frontend-vm2** are in the **app-frontend-avset** availability set.
    

![Virtual machines displayed in an availability set](https://labondemand.blob.core.windows.net/content/lab170099/g3mt1t82.jpg align="left")

---

# Configure a Virtual Machine Scale Set

In this challenge, you will configure an Azure virtual machine scale set. First, you will create a scale set that uses load balancing and a common Linux operating system disk image. Next, you will increase the number of virtual machines in the scale set. Finally, you will stop and deallocate a virtual machine instance.

1. Create a **Virtual Machine Scale Set (VMSS)** with the following specifications. Use default values for any unspecified properties.
    
    #### **Configuration Details**
    
    * **Resource Group:** `rg1lod49347709`
        
    * **VMSS Name:** `webappscaleset`
        
    * **Orchestration Mode:** `Uniform`
        
    * **Image:** `Ubuntu Server (latest version, x64 Gen2)`
        
    * **VM Size:** `DS1_v2`
        
    * **Authentication Type:** `Password`
        
    * **Username:** `azureuser`
        
    * **Password:** `******`
        
    * **Public IP Address:** `Enabled` (NIC Properties)
        
    * **Load Balancing Options:** `Azure Load Balancer`
        
    * **Load Balancer Selection:** `Create a new load balancer`
        
    * **Load Balancer Name:** `webappscaleset-lb`
        
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741918679963/1c930931-177e-44a5-b9aa-f7ec9c3fd5b4.png align="center")
    
2. Verify that there are two virtual machine instances running in the **webappscaleset** scale set.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741918944342/4b77046c-8c89-4735-84fc-e71af529ae6b.png align="center")

3. Increase the number of virtual machine instances to 3 in the webappscaleset scale set that is in the rg1lod49347709 resource group by using the az vmss scale command.
    

```plaintext
az vmss scale --resource-group rg1lod49347709 --name webappscaleset --new-capacity 3
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741919115244/5eeaaa0b-9365-40d5-8e5a-1042d1ac40ad.png align="center")

4. Deallocate the **webappscaleset\_0** virtual machine instance in the **webappscaleset** scale set(select the **webappscaleset\_0** check box, and then on the command bar, select **Stop**).
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741919188993/37816bc2-83e6-454d-b40b-d7ffcc1d7bde.png align="center")

---

# Work with Managed Disk Snapshots

In this challenge, you will create a new test virtual machine that is based on an existing managed disk. First, you will prepare to create a snapshot, and then you will create a snapshot of an existing managed disk. Next, you will create a managed disk from the snapshot. Finally, you will create a virtual machine from the new managed disk.

1. Use the ip of the vm and open the auto-scale web app:
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741925166810/d17778aa-81c3-4add-b366-3f7eb2ad5906.png align="center")
    
2. Stop and deallocate the vm
    
3. Create a snapshop from the vm disk that you can find in the resource group
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741925364099/be470d2d-7141-40fa-9dc7-03e291f52cf0.png align="center")

4. Start the vm again
    
5. Create a managed disk in the resource group by using snapshot
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741925510411/8ff48dfb-b7af-4686-88e1-e88cee327ebc.png align="center")

6. Create a vm that uses new disk created from snapshot (allow inbound http, and ssh and disable boot diagnostics)
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741925604153/10c1681f-0b0d-4992-aa6e-1096c117f116.png align="center")

7. Restart vm2 to reload the web app
    
8. Open the web app on vm2, verify that you get the same web
    

---

# Can You Design and Implement a Storage Solution on an Azure Virtual Machine?

In this Challenge Lab, you will deploy an Azure virtual machine and configure storage. First, you will create a virtual machine. Next, you will add a data disk to the virtual machine. Finally, you will resize the data disk, and then you will create a snapshot.

1. Create a vm with boot diagnostics enabled(with custom storage account)
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741926632570/429fda00-1ba9-41a8-a3fb-dd9412c9c90c.png align="center")

2. create a new disk and attach it to the vm
    
3. remote to the vm and initialize the disk and create a folder in the disk
    
4. minimize the remote desktop and create the snapshot of the disk
    
5. Enable guest-level monitoring for **VM1** by using the storage account.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741927470779/1082f06a-7958-42d1-9782-d119cf8562c5.png align="center")

6. Display the tables created for guest-level monitoring in the **corpdatalod49350227diag** storage account.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741927821214/b503b2a5-d203-4253-918a-ff8c68424158.png align="center")

7. Create a chart that displays the \\LogicalDisk(\_Total)\\Disk Bytes/sec **Guest (classic)** metric for **VM1** and a time range of the **last 30 minutes**.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741928071575/04de9d2c-b1b1-43d5-aaef-94537f8ed850.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741928121941/c2efa589-f3b7-475e-bb26-891bea049e01.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741928189612/63057453-58e5-4ef7-ae5b-22e7ab353d62.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741928292652/63e2ad35-8dcd-45a7-a15b-d35977a814c8.png align="center")

---

# Can You Provision a Serverless Container-Based Environment?

In this challenge, you will provision a container-based environment. The environment will include a container registry, a container instance, and a container-based web app.

1. Provision an Azure Container Registry named acr49377787 in the **Archlod49377787** resource group by using the **Basic** Pricing plan.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1741995894526/0c0e3105-aa88-44ae-92a2-7faaa02b6577.png align="center")

2. Enable admin user for the registry and record the password.
    
    ![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742011173634/cc9a7bae-66dd-4c90-a632-0c4bff41ae29.png align="center")
    
3. Configure an Azure Cloud Shell **Bash** session by using the existing **Archlod49377787** resource group, the existing **sa49377787** storage account, and a new file share named bash.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742011612797/02bbb410-fe15-4146-8d38-7256db7712c5.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742011573826/589b0127-764e-4815-9ce5-8e12ee8d9b51.png align="center")

4. Establish an ssh connection to the Docker host VM by using ssh, [student@dhpip49380771.eastus.cloudapp.azure.com](mailto:student@dhpip49380771.eastus.cloudapp.azure.com)++ as the username, and \*\*\*\*\*\*\* as the password.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742012029602/84e7ea5e-ad2c-425c-831e-3e0d33fbb623.png align="center")

5. Authenticate by using the Container Registry from the Docker host: docker login [acr49380771.azurecr.io](http://acr49380771.azurecr.io) using acr49380771 as the username and \*\*\*\* as the password.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742012274460/f5402ddd-9276-4038-9eae-e494710b47e1.png align="center")

6. Migrate the notlods/exampleservice:1.0 image from Docker Hub to your Container Registry by using the docker pull, docker tag, and docker push commands.
    

Pull the image from docker hub:

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742012508274/d703fba9-eb59-462b-ac04-c94acd0d6ded.png align="center")

Tag the image for your azure container registry (ACR):

based on previous info our ACR is: **acr49380771.azurecr.io**

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742012946517/5f738b2a-180e-48db-a559-e228fc729adb.png align="center")

login to the azure container:(authenticate with ACR before pushing the image)

push the image to ACR:

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742013259020/9f22933c-6d1a-49ae-b79b-3120dd6f9811.png align="center")

---

# Configure a Near Real-Time Metric Alert

In this challenge, you will configure a near real-time metric alert. First, you will create a Linux virtual machine. Next, you will create an action group, and then you will create a near real-time metric alert that uses the action group. Finally, you will test the alert.

1. Open an Azure Cloud Shell **Bash** session without mounting a storage account.
    
2. Create a new Linux virtual machine that generates an SSH key pair by using the az vm create command and the values in the following table:
    
    | **Property** | **Value** |
    | --- | --- |
    | Resource group | rg1lod49443856 |
    | Name | VM1 |
    | Image | Ubuntu2204 |
    | Size | Standard\_DS1\_v2 |
    | Admin Username | azureuser |
    

```bash
az vm create -g rg1lod49443856 --generate-ssh-keys --name VM1 --image Ubuntu2204 --size Standard_DS1_v2 --admin-username azureuser
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742231160971/6aa9c6d3-0c16-4f29-806a-0f3f6e874fd5.png align="center")

3. Kep record the **public IP address** of **VM1**
    
4. Create an SSH connection to the virtual machine by using azureuser@20.39.47.37
    
    ```bash
    ssh azureuser@20.39.47.37
    ```
    
5. Update the Linux virtual machine by using the sudo command and the apt-get tool with the update option.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742231414894/ffb72887-a160-459e-b272-2e91039ef735.png align="center")

3. Create an action group by using the values in the following table. For any property that is not specified, use the default value.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742231565494/3acea7fb-87d1-4e46-a337-dddf427decb5.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742231644166/c7f8d37a-ecf5-4b8e-aa2e-6cf675f31a09.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742231839002/a5f7c7b1-bbb9-420d-b8b2-28dc1f418131.png align="center")

You can create an action group before or during the creation of an alert rule by using the Azure portal, the *Set-AzActionGroup* cmdlet , or the *az monitor action-group create* Azure CLI 2.0 command.

You can use action groups to configure preferences for actions that you want Azure to take when a specific monitored event occurs.

4. Verify that your personal email has been added to the Cloud Operations action group(Check your email)
    
5. Create an alert rule named Percentage CPU greater than 85 for **VM1** that will send a notification that has a description of Alert when the average Percentage CPU is greater than 85 to the **Cloud Operations** alert group.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742233558039/a97b80fd-7c92-4106-a734-cc74840f1d17.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742234557489/a27dc95a-52a7-4ef2-a199-b1dc6d36b760.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742234646085/9e095c05-c3e0-4a63-8762-a9b653064444.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742234686191/5d28fcc5-c759-4ff9-8db7-4ecbca1fdf78.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742234745326/7fd33a26-49ad-45f7-afe5-8374bc27ea1f.png align="center")

You can create a metric alert rule by using the Azure portal, the *Add-AzMetricAlertRuleV2* cmdlet, or the *az monitor alert create* CLI 2.0 command.

6. Establish an SSH connection to VM1 by using Cloud Shell and the apt-get command to install the stress tool.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742234849991/9ae04e3b-aebc-4ab2-be32-fab78d82a486.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742234873148/01673403-4ea5-403b-b649-2fdbeab8bd61.png align="center")

7. Use the stress tool to generate a CPU load of 8 hogs on the virtual machine for a period of 480 seconds:
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742234946152/73e5f87f-bb39-4286-810c-235d72ae8d5b.png align="center")

8. Leave the Cloud Shell window open to ensure that the generated CPU load triggers a notification alert. It may take up to 10 minutes for the alert to become active.
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1742240042896/b03d4056-58d3-4f1f-89c6-14588f1c2804.png align="center")

You have accomplished the following:

* Created a Linux virtual machine.
    
* Created an action group.
    
* Created a near real-time metric alert on a virtual machine.
    
* Tested the near real-time metric alert.