Microsoft Microsoft Certifications AZ-104 Questions & Answers

• Question 151:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure subscription that contains the following users in an Azure Active Directory tenant named contoso.onmicrosoft.com:

  

  User1 creates a new Azure Active Directory tenant named external.contoso.onmicrosoft.com.

  You need to create new user accounts in external.contoso.onmicrosoft.com.

  Solution: You instruct User4 to create the user accounts.

  Does that meet the goal?

  A. yes

  B. No

  Correct Answer: B

  Only a global administrator can add users to this tenant.

  Reference:

  https://docs.microsoft.com/en-us/azure/devops/organizations/accounts/add-users-to-azure-ad

• Question 152:

  You have an Azure subscription that contains an Azure Active Directory (Azure AD) tenant named contoso.com and an Azure Kubernetes Service (AKS) cluster named AKS1.

  An administrator reports that she is unable to grant access to AKS1 to the users in contoso.com.

  You need to ensure that access to AKS1 can be granted to the contoso.com users.

  What should you do first?

  A. From contoso.com, modify the Organization relationships settings.

  B. From contoso.com, create an OAuth 2.0 authorization endpoint.

  C. Recreate AKS1.

  D. From AKS1, create a namespace.

  Correct Answer: B

  With Azure AD-integrated AKS clusters, you can grant users or groups access to Kubernetes resources within a namespace or across the cluster. To obtain a kubectl configuration context, a user can run the az aks get-credentials command.

  When a user then interacts with the AKS cluster with kubectl, they're prompted to sign in with their Azure AD credentials. This approach provides a single source for user account management and password credentials. The user can only

  access the resources as defined by the cluster administrator.

  Azure AD authentication is provided to AKS clusters with OpenID Connect. OpenID Connect is an identity layer built on top of the OAuth 2.0 protocol. For more information on OpenID Connect, see the Open ID connect documentation. From

  inside of the Kubernetes cluster, Webhook Token Authentication is used to verify authentication tokens. Webhook token authentication is configured and managed as part of the AKS cluster.

  

  Reference:

  https://kubernetes.io/docs/reference/access-authn-authz/authentication/ https://docs.microsoft.com/en-us/azure/aks/concepts-identity

• Question 153:

  You have an Active Directory domain named contoso.com that contains the objects shown in the following table.

  

  The groups have the memberships shown in the following table.

  

  OU1 and OU2 are synced to Azure Active Directory (Azure AD).

  You modify the synchronization settings and remove OU1 from synchronization. You sync Active Directory and Azure AD.

  Which objects are in Azure AD?

  OU1 and OU2 are synced to Azure Active Directory (Azure AD). You modify the synchronization settings and remove OU1 from synchronization. You sync Active Directory and Azure AD.

  Which objects are in Azure AD?

  A. User4 and Group2 only

  B. User2, Group1, User4, and Group2 only

  C. User1, User2, Group1, User4, and Group2 only

  D. User1, User2, User3, User4, Group1, and Group2

  Correct Answer: C

• Question 154:

  You have an Azure subscription that contains an Azure Active Directory (Azure AD) tenant named adatum.com. The tenant contains 500 user accounts.

  You deploy Microsoft Office 365. You configure Office 365 to use the user accounts in adatum.com.

  You configure 60 users to connect to mailboxes in Microsoft Exchange Online.

  You need to ensure that the 60 users use Azure Multi-Factor Authentication (MFA) to connect to the Exchange Online mailboxes. The solution must only affect connections to the Exchange Online mailboxes.

  What should you do?

  A. From the multi-factor authentication page, configure the Multi-Factor Auth status for each user

  B. From Azure Active Directory admin center, create a conditional access policy

  C. From the multi-factor authentication page, modify the verification options

  D. From the Azure Active Directory admin center, configure an authentication method

  Correct Answer: A

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-userstates

• Question 155:

  You have an Azure virtual machine named VM1.

  The network interface for VM1 is configured as shown in the exhibit. (Click the Exhibit tab.)

  

  You deploy a web server on VM1, and then create a secure website that is accessible by using the HTTPS protocol VM1 is used as a web server only.

  You need to ensure that users can connect to the website from the Internet.

  What should you do?

  A. Change the priority of Rule3 to 450.

  B. Change the priority of Rule6 to 100

  C. DeleteRule1.

  D. Create a new inbound rule that allows TCP protocol 443 and configure the protocol to have a priority of 501.

  E. For Rule5, change the Action to Allow and change the priority to 401

  Correct Answer: E

  HTTPS uses port 443.

  Rule2, with priority 500, denies HTTPS traffic.

  Rule5, with priority changed from 2000 to 401, would allow HTTPS traffic.

  Note: Priority is a number between 100 and 4096. Rules are processed in priority order, with lower numbers processed before higher numbers, because lower numbers have higher priority. Once traffic matches a rule, processing stops. As a

  result, any rules that exist with lower priorities (higher numbers) that have the same attributes as rules with higher priorities are not processed.

  Reference:

  https://docs.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview

• Question 156:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure subscription that contains the following resources:

  1.

  A virtual network that has a subnet named Subnet1

  2.

  Two network security groups (NSGs) named NSG-VM1 and NSG-Subnet1

  3.

  A virtual machine named VM1 that has the required Windows Server configurations to allow Remote Desktop connections

  NSG-Subnet1 has the default inbound security rules only.

  NSG-VM1 has the default inbound security rules and the following custom inbound security rule:

  1.

  Priority: 100

  2.

  Source: Any

  3.

  Source port range: *

  4.

  Destination: *

  5.

  Destination port range: 3389

  6.

  Protocol: UDP

  7.

  Action: Allow

  VM1 has a public IP address and is connected to Subnet1. NSG-VM1 is associated to the network interface of VM1. NSG-Subnet1 is associated to Subnet1.

  You need to be able to establish Remote Desktop connections from the internet to VM1.

  Solution: You add an inbound security rule to NSG-Subnet1 that allows connections from the internet source to the VirtualNetwork destination for port range 3389 and uses the UDP protocol.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  The default port for RDP is TCP port 3389 not UDP.

  NSGs deny all inbound traffic except from virtual network or load balancers. For inbound traffic, Azure processes the rules in a network security group associated to a subnet first, and then the rules in a network security group associated to

  the network interface. By default NSG rule to allow traffic through RDP port 3389 is not created automatically during the creation of VM , unless you change the setting during creation. Here in the solution UDP traffic is allowed at virtual

  network level which is not tcp/rdp protocol. So this will not work to achieve the goal.

  References:

  https://docs.microsoft.com/en-us/azure/virtual-machines/troubleshooting/troubleshoot-rdp- connection

  https://docs.microsoft.com/en-us/azure/virtual-network/security-overview#default-security-rules

• Question 157:

  Your on-premises network contains an Active Directory domain named adatum.com that is synced to Azure Active Directory (Azure AD). Password writeback is disabled. In adatum.com, you create the users shown in the following table.

  

  Which users must sign in from a computer joined to adatum.com?

  A. User2 only

  B. User1 and User3 only

  C. User1, User2, and User3

  D. User2 and User3 only

  E. User1 only

  Correct Answer: E

  Password writeback is a feature enabled with Azure AD Connect that allows password changes in the cloud to be written back to an existing on-premises directory in real time.

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-writeback

• Question 158:

  You have the Azure virtual machines shown in the following table.

  

  A DNS service is installed on VM1.

  You configure the DNS servers settings for each virtual network as shown in the following exhibit.

  

  You need to ensure that all the virtual machines can resolve DNS names by using the DNS service on VM1. What should you do?

  A. Configure a conditional forwarder on VM1

  B. Add service endpoints on VNET1

  C. Add service endpoints on VNET2 and VNET3

  D. Configure peering between VNET1, VNET2, and VNET3

  Correct Answer: D

  Virtual network peering enables you to seamlessly connect networks in Azure Virtual Network. The virtual networks appear as one for connectivity purposes. The traffic between virtual machines uses the Microsoft backbone infrastructure.

  Incorrect Answers:

  B, C: Virtual Network (VNet) service endpoint provides secure and direct connectivity to Azure services over an optimized route over the Azure backbone network. Endpoints allow you to secure your critical Azure service resources to only

  your virtual networks. Service Endpoints enables private IP addresses in the VNet to reach the endpoint of an Azure service without needing a public IP address on the VNet.

  Reference:

  https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview

  https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview

• Question 159:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure subscription that contains the following users in an Azure Active Directory tenant named contoso.onmicrosoft.com:

  

  User1 creates a new Azure Active Directory tenant named external.contoso.onmicrosoft.com.

  You need to create new user accounts in external.contoso.onmicrosoft.com.

  Solution: You instruct User1 to create the user accounts.

  Does that meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  In the given scenario, User1, who is a Global Administrator, creates a new Azure Active Directory tenant named external.contoso.onmicrosoft.com. As a Global Administrator, User1 has the necessary permissions to create new user accounts in the Azure AD tenant.

  Therefore, instructing User1 to create the user accounts in the new external.contoso.onmicrosoft.com tenant is a valid and appropriate solution. User1 has the required privileges and can perform the necessary administrative actions to create new user accounts within the newly created Azure AD tenant.

  References: https://docs.microsoft.com/en-us/azure/devops/organizations/accounts/add-users-to-azure-ad

• Question 160:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure subscription that contains the following users in an Azure Active Directory tenant named contoso.onmicrosoft.com:

  

  User1 creates a new Azure Active Directory tenant named external.contoso.onmicrosoft.com.

  You need to create new user accounts in external.contoso.onmicrosoft.com.

  Solution: You instruct User3 to create the user accounts.

  Does that meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Only a global administrator can add users to this tenant.

  References:

  https://docs.microsoft.com/en-us/azure/devops/organizations/accounts/add-users-to-azure-ad