Microsoft Microsoft Certifications AZ-104 Questions & Answers

• Question 91:

  You plan to back up an Azure virtual machine named VM1.

  You discover that the Backup Pre-Check status displays a status of Warning.

  What is a possible cause of the Warning status?

  A. VM1 is stopped.

  B. VM1 does not have the latest version of the Azure VM Agent (WaAppAgent.exe) installed.

  C. VM1 has an unmanaged disk.

  D. A Recovery Services vault is unavailable.

  Correct Answer: B

  The Warning state indicates one or more issues in VM's configuration that might lead to backup failures and provides recommended steps to ensure successful backups. Not having the latest VM Agent installed, for example, can cause backups to fail intermittently and falls in this class of issues.

  Reference: https://azure.microsoft.com/en-us/blog/azure-vm-backup-pre-checks/

• Question 92:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure subscription that contains the virtual machines shown in the following table.

  

  You deploy a load balancer that has the following configurations:

  1.

  Name: LB1

  2.

  Type: Internal

  3.

  SKU: Standard

  4.

  Virtual network: VNET1

  You need to ensure that you can add VM1 and VM2 to the backend pool of LB1.

  Solution: You create a Standard SKU public IP address, associate the address to the network interface of VM1, and then stop VM2.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  You can only attach virtual machines that are in the same location and on the same virtual network as the LB. Virtual machines must have a standard SKU public IP or no public IP.

  The LB needs to be a standard SKU to accept individual VMs outside an availability set or vmss. VMs do not need to have public IPs but if they do have them they have to be standard SKU. Vms can only be from a single network. When they

  don't have a public IP they are assigned an ephemeral IP.

  Also, when adding them to a backend pool, it doesn't matter in which status are the VMs.

  Note: Load balancer and the public IP address SKU must match when you use them with public IP addresses.

  Reference:

  https://docs.microsoft.com/en-us/azure/load-balancer/backend-pool-management

• Question 93:

  You have an Azure subscription that contains a virtual machine named VM1. VM1 hosts a line-of-business application that is available 24 hours a day. VM1 has one network interface and one managed disk. VM1 uses the D4s v3 size. You plan to make the following changes to VM1:

  1.

  Change the size to D8s v3.

  2.

  Add a 500-GB managed disk.

  3.

  Add the Puppet Agent extension.

  4.

  Enable Desired State Configuration Management. Which change will cause downtime for VM1?

  A. Enable Desired State Configuration Management

  B. Add a 500-GB managed disk

  C. Change the size to D8s v3

  D. Add the Puppet Agent extension

  Correct Answer: C

  Changing the size of an Azure virtual machine involves a stop and restart of the virtual machine, which will cause downtime for the line-of-business application hosted on VM1. This downtime can be minimized by using Azure Availability Sets or by taking appropriate steps to prepare for the change, such as backing up data or moving the application to another virtual machine.

  Adding a managed disk, installing the Puppet Agent extension, or enabling Desired State Configuration Management should not cause downtime for VM1.

  Reference: https://azure.microsoft.com/en-us/blog/resize-virtual-machines/

• Question 94:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You need to ensure that an Azure Active Directory (Azure AD) user named Admin1 is assigned the required role to enable Traffic Analytics for an Azure subscription.

  Solution: You assign the Reader role at the subscription level to Admin1.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

• Question 95:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure virtual machine named VM1 that runs Windows Server 2016.

  You need to create an alert in Azure when more than two error events are logged to the System event log on VM1 within an hour.

  Solution: You create an event subscription on VM1. You create an alert in Azure Monitor and specify VM1 as the source

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  You need to specify Log Analytics as the source for this alert, and not the VM as source for the alert.

  1.

  You create an Azure Log Analytics workspace and configure the data settings.

  2.

  You install the Microsoft Monitoring Agent on VM1.

  3.

  You create an alert in Azure Monitor and specify the Log Analytics workspace as the source.

  Reference: https://docs.microsoft.com/en-us/azure/azure-monitor/platform/agents-overview

• Question 96:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure subscription that contains the resources shown in the following table.

  

  VM1 connects to VNET1.

  You need to connect VM1 to VNET2.

  Solution: You turn off VM1, and then you add a new network interface to VM1.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Instead you should delete VM1. You recreate VM1, and then you add the network interface for VM1.

  Note: When you create an Azure virtual machine (VM), you must create a virtual network (VNet) or use an existing VNet. You can change the subnet a VM is connected to after it's created, but you cannot change the VNet.

  Reference:

  https://docs.microsoft.com/en-us/azure/virtual-machines/windows/network-overview

• Question 97:

  You have an existing Azure subscription that contains 10 virtual machines.

  You need to monitor the latency between your on-premises network and the virtual machines.

  What should you use?

  A. Service Map

  B. Connection troubleshoot

  C. Network Performance Monitor

  D. Effective routes

  Correct Answer: C

  Network Performance Monitor is a cloud-based hybrid network monitoring solution that helps you monitor network performance between various points in your network infrastructure. It also helps you monitor network connectivity to service

  and application endpoints and monitor the performance of Azure ExpressRoute.

  You can monitor network connectivity across cloud deployments and on-premises locations, multiple data centers, and branch offices and mission-critical multitier applications or microservices. With Performance Monitor, you can detect

  network issues before users complain.

  Reference:

  https://docs.microsoft.com/en-us/azure/azure-monitor/insights/network-performance-monitor

• Question 98:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You need to ensure that an Azure Active Directory (Azure AD) user named Admin1 is assigned the required role to enable Traffic Analytics for an Azure subscription.

  Solution: You assign the Network Contributor role at the subscription level to Admin1.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  Your account must meet one of the following to enable traffic analytics:

  Your account must have any one of the following Azure roles at the subscription scope: owner, contributor, reader, or network contributor.

  Reference: https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics-faq

• Question 99:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You need to ensure that an Azure Active Directory (Azure AD) user named Admin1 is assigned the required role to enable Traffic Analytics for an Azure subscription.

  Solution: You assign the Owner role at the subscription level to Admin1.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  Your account must meet one of the following to enable traffic analytics:

  Your account must have any one of the following Azure roles at the subscription scope: owner, contributor, reader, or network contributor.

  Reference:

  https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics-faq

• Question 100:

  You have the Azure virtual network named VNet1 that contains a subnet named Subnet1. Subnet1 contains three Azure virtual machines. Each virtual machine has a public IP address.

  The virtual machines host several applications that are accessible over port 443 to users on the Internet.

  Your on-premises network has a site-to-site VPN connection to VNet1.

  You discover that the virtual machines can be accessed by using the Remote Desktop Protocol (RDP) from the Internet and from the on-premises network.

  You need to prevent RDP access to the virtual machines from the Internet, unless the RDP connection is established from the on-premises network. The solution must ensure that all the applications can still be accessed by the Internet users.

  What should you do?

  A. Modify the address space of the local network gateway.

  B. Remove the public IP addresses from the virtual machines.

  C. Modify the address space of Subnet1.

  D. Create a deny rule in a network security group (NSG) that is linked to Subnet1.

  Correct Answer: D

  You can filter network traffic to and from Azure resources in an Azure virtual network with a network security group. A network security group contains security rules that allow or deny inbound network traffic to, or outbound network traffic from, several types of Azure resources. You can use a site-to-site VPN to connect your on-premises network to an Azure virtual network. Users on your on-premises network connect by using the RDP or SSH protocol over the site-to-site VPN connection. You don't have to allow direct RDP or SSH access over the internet. And this can be achieved by configuring a deny rule in a network security group (NSG) that is linked to Subnet1 for RDP / SSH protocol coming from internet.

  Modify the address space of Subnet1 : Incorrect choice Modifying the address space of Subnet1 will have no impact on RDP traffic flow to the virtual network. Modify the address space of the local network gateway : Incorrect choice Modifying the address space of the local network gateway will have no impact on RDP traffic flow to the virtual network. Remove the public IP addresses from the virtual machines : Incorrect choice If you remove the public IP addresses from the virtual machines, none of the applications be accessible publicly by the Internet users.

  Reference: https://docs.microsoft.com/en-us/azure/virtual-network/security-overview https://docs.microsoft.com/en-us/azure/security/fundamentals/network-best-practices