Microsoft Role-based AZ-104 Questions & Answers

• Question 1:

  You have two Azure subscriptions named Sub1 and Sub2.

  An administrator creates a custom role that has an assignable scope to a resource group named RG1 in Sub1.

  You need to ensure that you can apply the custom role to any resource group in Sub1 and Sub2.

  The solution must minimize administrative effort.

  What should you do?

  A. Create a new custom role for Sub1 and add Sub2 to the assignable scopes. Remove the role from RG1.

  B. Select the custom role and add Sub1 and Sub2 to the assignable scopes. Remove RG1 from the assignable scopes.

  C. Select the custom role and add Sub1 to the assignable scopes. Remove RGi from the assignable scopes. Create a new custom role for Sub2.

  D. Create a new custom role for Sub1. Create a new custom role for Sub2. Remove the role from RG1.

  Correct Answer: B

• Question 2:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure Active Directory (Azure AD) tenant named contoso.com.

  You have a CSV file that contains the names and email addresses of 500 external users.

  You need to create a guest user account in contoso.com for each of the 500 external users.

  Solution: You create a PowerShell script that runs the New-MgUser cmdlet for each external user.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Wrong module.

  New-MgUser

  Module: Microsoft.Graph.Users

  Create a new user.

  Instead use the New-AzureADMSInvitation cmdlet which is used to invite a new external user to your directory.

  Reference:

  https://docs.microsoft.com/en-us/powershell/module/azuread/new-azureadmsinvitation

• Question 3:

  You have an Azure AD tenant named adatum.com that contains the groups shown in the following table.

  

  Adatum.com contains the users shown in the following table.

  

  You assign the Azure Active Directory Premium Plan 2 license to Group1 and User4. Which users are assigned the Azure Active Directory Premium Plan 2 license?

  A. User4 only

  B. User1 and User4 only

  C. User1, User2, and User4 only

  D. User1, User2, User3, and User4

  Correct Answer: B

• Question 4:

  You have an Azure Active Directory (Azure AD) tenant named contoso.com.

  You have a CSV file that contains the names and email addresses of 500 external users.

  You need to create a guest user account in contoso.com for each of the 500 external users.

  Solution: You create a PowerShell script that runs the New-AzureADUser cmdlet for each user.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  The New-AzureADUser cmdlet creates a user in Azure Active Directory (Azure AD).

  Instead use the New-AzureADMSInvitation cmdlet which is used to invite a new external user to your directory.

  Reference:

  https://docs.microsoft.com/en-us/powershell/module/azuread/new-azureadmsinvitation

• Question 5:

  You have an Azure Active Directory (Azure AD) tenant named contoso.com.

  You have a CSV file that contains the names and email addresses of 500 external users.

  You need to create a guest user account in contoso.com for each of the 500 external users.

  Solution: You create a PowerShell script that runs the New-AzureADMSInvitation cmdlet for each external user.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  Use the New-AzureADMSInvitation cmdlet which is used to invite a new external user to your directory.

  Reference: https://docs.microsoft.com/en-us/powershell/module/azuread/new-azureadmsinvitation

• Question 6:

  You plan to deploy the resources shown in the following table.

  

  You need to create a single Azure Resource Manager (ARM) template that will be used to deploy the resources. Which resource should be added to the depends On section for VM1?

  A. NIC1

  B. VNET1

  C. NSG1

  D. IP1

  Correct Answer: A

  Therefore, the most direct and crucial dependency for VM1 among the listed resources is NIC1. The NIC acts as the bridge between the VM and the other network resources like the virtual network, public IP, and network security group. Hence, it's essential to ensure that NIC1 is deployed before VM1.

  https://learn.microsoft.com/en-us/azure/templates/microsoft.compute/virtualmachines?pivots=deployment-language-arm-template https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/resource-dependency https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/template-tutorial-create-templates-with-dependent-resources?tabs=CLI

• Question 7:

  You have two Azure virtual machines named VM1 and VM2 that run Windows Server. The virtual machines are in a subnet named Subnet1. Subnet1 is in a virtual network named VNet1.

  You need to prevent VM1 from accessing VM2 on port 3389.

  What should you do?

  A. Create a network security group (NSG) that has an outbound security rule to deny destination port 3389 and apply the NSG to the network interface of VM1.

  B. Configure Azure Bastion in VNet1.

  C. Create a network security group (NSG) that has an outbound security rule to deny source port 3389 and apply the NSG to Subnet1.

  D. Create a network security group (NSG) that has an inbound security rule to deny source port 3389 and apply the NSG to Subnet1.

  Correct Answer: A

  By creating an outbound security rule in a network security group (NSG) to deny destination port 3389, you can prevent VM1 from accessing port 3389 on VM2. By applying the NSG to the network interface of VM1, you can enforce the security rule specifically for VM1.

  This solution provides a centralized way to manage and enforce network security for VM1, and it helps to prevent unwanted access to port 3389 on VM2 from VM1.

• Question 8:

  You have an Azure subscription that contains a storage account named storage1.

  You plan to create a blob container named container1.

  You need to use customer-managed key encryption for container1.

  Which key should you use?

  A. an EC key that uses the P-384 curve only

  B. an EC key that uses the P-521 curve only

  C. an EC key that uses the P-384 curve or P-521 curve only

  D. an RSA key with a key size of 4096 only

  E. an RSA key type with a key size of 2048, 3072, or 4096 only

  Correct Answer: E

  Enable customer-managed keys for a storage account

  The key vault that stores the key must have both soft delete and purge protection enabled. Azure storage encryption supports RSA and RSA-HSM keys of sizes 2048, 3072 and 4096.

  Reference:

  https://learn.microsoft.com/en-us/azure/storage/common/customer-managed-keys-overview

• Question 9:

  You have an Azure subscription that contains the resources shown in the following table.

  

  You need to manage outbound traffic from VNET1 by using Firewall1. What should you do first?

  A. Configure the Hybrid Connection Manager.

  B. Upgrade ASP1 to the Premium SKU.

  C. Create a route table.

  D. Create an Azure Network Watcher.

  Correct Answer: C

  Integrate your app with an Azure virtual network, network routing

  You can use route tables to route outbound traffic from your app without restriction. Common destinations can include firewall devices or gateways.

  Route tables and network security groups only apply to traffic routed through the virtual network integration.

  Reference: https://learn.microsoft.com/en-us/azure/app-service/overview-vnet-integration

• Question 10:

  You have an Azure subscription that contains a storage account. The account stores website data.

  You need to ensure that inbound user traffic uses the Microsoft point-of-presence (POP) closest to the user's location.

  What should you configure?

  A. private endpoints

  B. Azure Firewall rules

  C. Routing preference

  D. load balancing

  Correct Answer: C

  Network routing preference for Azure Storage You can configure network routing preference for your Azure storage account to specify how network traffic is routed to your account from clients over the internet. By default, traffic from the internet is routed to the public endpoint of your storage account over the Microsoft global network. Azure Storage provides additional options for configuring how traffic is routed to your storage account.

  Configuring routing preference gives you the flexibility to optimize your traffic either for premium network performance or for cost. When you configure a routing preference, you specify how traffic will be directed to the public endpoint for your storage account by default. You can also publish route-specific endpoints for your storage account.

  Note: Microsoft global network versus Internet routing By default, clients outside of the Azure environment access your storage account over the Microsoft global network. The Microsoft global network is optimized for low-latency path selection to deliver premium network performance with high reliability. Both inbound and outbound traffic are routed through the point of presence (POP) that is closest to the client. This default routing configuration ensures that traffic to and from your storage account traverses over the Microsoft global network for the bulk of its path, maximizing network performance.

  You can change the routing configuration for your storage account so that both inbound and outbound traffic are routed to and from clients outside of the Azure environment through the POP closest to the storage account. This route minimizes the traversal of your traffic over the Microsoft global network, handing it off to the transit ISP at the earliest opportunity. Utilizing this routing configuration lowers networking costs.

  Reference: https://learn.microsoft.com/en-us/azure/storage/common/network-routing-preference