Microsoft Role-based AZ-104 Questions & Answers

• Question 111:

  You have a Recovery Service vault that you use to test backups. The test backups contain two protected virtual machines.

  You need to delete the Recovery Services vault.

  What should you do first?

  A. From the Recovery Service vault, stop the backup of each backup item.

  B. From the Recovery Service vault, delete the backup data.

  C. Modify the disaster recovery properties of each virtual machine.

  D. Modify the locks of each virtual machine.

  Correct Answer: A

  You can't delete a Recovery Services vault if it is registered to a server and holds backup data. If you try to delete a vault, but can't, the vault is still configured to receive backup data.

  Remove vault dependencies and delete vault

  In the vault dashboard menu, scroll down to the Protected Items section, and click Backup Items. In this menu, you can stop and delete Azure File Servers, SQL Servers in Azure VM, and Azure virtual machines.

  

  References: https://docs.microsoft.com/en-us/azure/backup/backup-azure-delete-vault

• Question 112:

  You have the Azure virtual machines shown in the following table.

  

  You have a Recovery Services vault that protects VM1 and VM2. You need to protect VM3 and VM4 by using Recovery Services. What should you do first?

  A. Configure the extensions for VM3 and VM4.

  B. Create a new Recovery Services vault.

  C. Create a storage account.

  D. Create a new backup policy.

  Correct Answer: B

  VM3 and VM4 are in a different region from VM1 and VM2. So, we need to create a new Recovery Services Vault in the same region with VM3 and VM4. For storage account, it is created automatically by Azure.

  A Recovery Services vault is a storage entity in Azure that houses data. The data is typically copies of data, or configuration information for virtual machines (VMs), workloads, servers, or workstations. You can use Recovery Services vaults to hold backup data for various Azure services.

  Reference: https://docs.microsoft.com/en-us/azure/site-recovery/azure-to-azure-tutorial-enable-replication

• Question 113:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure Directory (Azure AD) tenant named Adatum and an Azure Subscription named Subscription1. Adatum contains a group named Developers. Subscription1 contains a resource group named Dev.

  You need to provide the Developers group with the ability to create Azure logic apps in the Dev resource group.

  Solution: On Subscription1, you assign the Logic App Operator role to the Developers group.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  The Logic App Operator role only lets you read, enable and disable logic app. With it you can view the logic app and run history, and enable/disable. Cannot edit or update the definition.

  You would need the Logic App Contributor role.

  References:

  https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles https://docs.microsoft.com/en-us/azure/logic-apps/logic-apps-securing-a-logic-app

• Question 114:

  You have an Azure subscription that contains a user account named User1. You need to ensure that User1 can assign a policy to the tenant root management group. What should you do?

  A. Create a new management group and delegate User1 as the owner of the new management group.

  B. Assign the Owner role for the Azure subscription to User1, and then instruct User1 to configure access management for Azure resources.

  C. Assign the Owner role for the Azure subscription to User1, and then modify the default conditional access policies.

  D. Assign the Global administrator role to User1, and then instruct User1 to configure access management for Azure resources.

  Correct Answer: D

• Question 115:

  Your on-premises network contains an SMB share named Share1. You have an Azure subscription that contains the following resources:

  1.

  A web app named webapp1

  2.

  A virtual network named VNET1

  You need to ensure that webapp1 can connect to Share1.

  What should you deploy?

  A. an Azure Application Gateway

  B. an Azure Active Directory (Azure AD) Application Proxy

  C. an Azure Virtual Network Gateway

  Correct Answer: C

  A Site-to-Site VPN gateway connection can be used to connect your on-premises network to an Azure virtual network over an IPsec/IKE (IKEv1 or IKEv2) VPN tunnel. This type of connection requires a VPN device, a VPN gateway, located on-premises that has an externally facing public IP address assigned to it.

  Incorrect Answers:

  B: Application Proxy is a feature of Azure AD that enables users to access on-premises web applications from a remote client.

  Reference: https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-site-to-site-resource-manager-portal

• Question 116:

  You have an Azure web app named webapp1.

  Users report that they often experience HTTP 500 errors when they connect to webapp1.

  You need to provide the developers of webapp1 with real-time access to the connection errors. The solution must provide all the connection error details.

  What should you do first?

  A. From webapp1, enable Web server logging

  B. From Azure Monitor, create a workbook

  C. From Azure Monitor, create a Service Health alert

  D. From webapp1, turn on Application Logging

  Correct Answer: A

  To resolve this you need to catch connection error. When the connection fails for webapp, it happens on web server, not within application. You can find out the web server log by below steps:

  Open the web application --> Go to Application Service logs --> Go to Web server logging (there are multiple switches there)

  You can also see the errors live going to "Log stream" pane. To ensure that you will get web server log, you have to enable it.

  

  Reference: https://docs.microsoft.com/en-us/azure/app-service/troubleshoot-diagnostic-logs

• Question 117:

  You have an Azure subscription that contains a policy-based virtual network gateway named GW1 and a virtual network named VNet1.

  You need to ensure that you can configure a point-to-site connection from an on-premises computer to VNet1.

  Which two actions should you perform? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Add a service endpoint to VNet1

  B. Reset GW1

  C. Create a route-based virtual network gateway

  D. Add a connection to GW1

  E. Delete GW1

  F. Add a public IP address space to VNet1

  Correct Answer: CE

  C: A VPN gateway is used when creating a VPN connection to your on-premises network.

  Route-based VPN devices use any-to-any (wildcard) traffic selectors, and let routing/forwarding tables direct traffic to different IPsec tunnels. It is typically built on router platforms where each IPsec tunnel is modeled as a network interface or

  VTI (virtual tunnel interface).

  E: Policy-based VPN devices use the combinations of prefixes from both networks to define how traffic is encrypted/decrypted through IPsec tunnels. It is typically built on firewall devices that perform packet filtering. IPsec tunnel encryption

  and decryption are added to the packet filtering and processing engine.

  Incorrect Answers:

  F: Point-to-Site connections do not require a VPN device or a public-facing IP address.

  Reference:

  https://docs.microsoft.com/en-us/azure/vpn-gateway/create-routebased-vpn-gateway-portal

  https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-connect-multiple-policybased-rm-ps

• Question 118:

  You have a virtual network named VNet1 as shown in the exhibit. (Click the Exhibit tab.)

  

  No devices are connected to VNet1.

  You plan to peer VNet1 to another virtual network named VNet2 in the same region. VNet2 has an address space of 10.2.0.0/16.

  You need to create the peering.

  What should you do first?

  A. Configure a service endpoint on VNet2.

  B. Modify the address space of VNet1.

  C. Add a gateway subnet to VNet1.

  D. Create a subnet on VNet1 and VNet2.

  Correct Answer: B

  The virtual networks you peer must have non-overlapping IP address spaces. The exhibit indicates that VNet1 has an address space of 10.2.0.0/16, which is the same as VNet2, and thus overlaps. We need to change the address space for

  VNet1.

  References:

  https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-manage- peering#requirements-and-constraints

• Question 119:

  You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers.

  You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines.

  You need to ensure that visitors are serviced by the same web server for each request.

  What should you configure?

  A. Floating IP (direct server return) to Enabled

  B. Idle Time-out (minutes) to 20

  C. Protocol to UDP

  D. Session persistence to Client IP and Protocol

  Correct Answer: D

  With Sticky Sessions when a client starts a session on one of your web servers, session stays on that specific server. To configure An Azure Load-Balancer For Sticky Sessions set Session persistence to Client IP.

  Note:

  There are several versions of this question in the exam. The question can have other incorrect answer options, including the following:

  1.

  Idle Time-out (minutes) to 20

  2.

  Protocol to UDP

  Reference: https://cloudopszone.com/configure-azure-load-balancer-for-sticky-sessions/

• Question 120:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure subscription that contains 10 virtual networks. The virtual networks are hosted in separate resource groups.

  Another administrator plans to create several network security groups (NSGs) in the subscription.

  You need to ensure that when an NSG is created, it automatically blocks TCP port 8080 between the virtual networks.

  Solution: You create a resource lock, and then you assign the lock to the subscription.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  How can I freeze or lock my production/critical Azure resources from accidental deletion? There is way to do this with both ASM and ARM resources using Azure resource lock.

  References: https://blogs.msdn.microsoft.com/azureedu/2016/04/27/using-azure-resource-manager-policy-and-azure-lock-to-control-your-azure-resources/