Microsoft Role-based AZ-104 Questions & Answers

• Question 11:

  You have an Azure subscription that contains 10 network security groups (NSGs), 10 virtual machines, and a Log Analytics workspace named Workspace1. Each NSG is connected to a virtual machine.

  You need to configure an Azure Monitor Network Insights alert that will be triggered when suspicious network traffic is detected.

  What should you do first?

  A. Deploy Connection Monitor.

  B. Configure data collection endpoints.

  C. Configure a private link.

  D. Configure NSG flow logs.

  Correct Answer: D

  Azure Monitor Network Insights is structured around these key components of monitoring:

  Topology

  Network health and metrics

  Connectivity

  Traffic

  Diagnostic Toolkit

  Traffic

  The Traffic tab provides access to all NSGs configured for NSG flow logs and Traffic Analytics for the selected set of subscriptions, grouped by location. The search functionality provided on this tab enables you to identify the NSGs configured

  for the searched IP address. You can search for any IP address in your environment. The tiled regional view will display all NSGs along with the NSG flow logs and Traffic Analytics configuration status.

  TheAlert box on the right side of the page provides a view of all Traffic Analytics workspace-based alerts across all subscriptions. Select the alert counts to go to a detailed alerts page.

  Why use Flow Logs?

  It is vital to monitor, manage, and know your own network for uncompromised security, compliance, and performance. Knowing your own environment is of paramount importance to protect and optimize it. You often need to know the current

  state of the network, who is connecting, where they're connecting from, which ports are open to the internet, expected network behavior, irregular network behavior, and sudden rises in traffic.

  Reference:

  https://learn.microsoft.com/en-us/azure/network-watcher/network-insights-overview

• Question 12:

  You need to configure an Azure web app named contoso.azurewebsites.net to host www.contoso.com. What should you do first?

  A. Create a TXT record named wwsv.contoso.com that has a value of contosoazurewebsites.net.

  B. Create a TXT record named asuid that contains the domain verification ID.

  C. Create a CNAME record named asuid that contains the domain verification ID.

  D. Create A records named www.contoso.com and asuid.contoso.com.

  Correct Answer: B

  https://learn.microsoft.com/en-us/azure/app-service/app-service-web-tutorial-custom-domain?tabs=a%2Cazurecli

• Question 13:

  You have an Azure subscription that contains eight virtual machines and the resources shown in the following table.

  

  You need to configure access for VNET1. The solution must meet the following requirements:

  The virtual machines connected to VNET1 must be able to communicate with the virtual machines connected to VNET2 by using the Microsoft backbone.

  The virtual machines connected to VNET1 must be able to access storage1, storage2 and Azure AD by using the Microsoft backbone.

  What is the minimum number of service endpoints you should add to VNET1?

  B. 2

  C. 5

  D. 3

  Correct Answer: B

• Question 14:

  You have an on-premises network.

  You have an Azure subscription that contains three virtual networks named VNET1, VNET2, and VNET3. The virtual networks are peered and connected to the on-premises network. The subscription contains the virtual machines shown in the following table.

  

  You need to monitor connectivity between the virtual machines and the on-premises network by using Connection Monitor. What is the minimum number of connection monitors you should deploy?

  A. 1

  B. 2

  C. 3

  D. 4

  Correct Answer: B

  Connection monitor resource: A region-specific Azure resource. https://learn.microsoft.com/en-us/azure/network-watcher/connection-monitor-create-using-portal#before-you-begin

• Question 15:

  You have an Azure subscription that contains the resources shown in the following table.

  

  You need to assign User1 the Storage File Data SMB Share Contributor role for share1. What should you do first?

  A. Modify the security profile for the file shares in storage1.

  B. Configure Access control (IAM) for share1.

  C. Select Default to Azure Active Directory authorization in the Azure portal for storage1.

  D. Enable identity-based data access for the file shares in storage1.

  Correct Answer: B

• Question 16:

  You have an Azure Subscription that contains the virtual networks Shown in the following table.

  

  All the virtual networks are peered. Each virtual network contains nine virtual machines.

  You need to configure secure RDP corrections to the virtual machines by using Azure Boston.

  Whit is the minimum number of Bastion nests required?

  A. 1

  B. 3

  C. 9

  D. 10

  Correct Answer: A

  Azure Bastion and VNet peering can be used together. When VNet peering is configured, you don't have to deploy Azure Bastion in each peered VNet. This means if you have an Azure Bastion host configured in one virtual network (VNet), it can be used to connect to VMs deployed in a peered VNet without deploying an additional bastion host. For more information about VNet peering, see About virtual network peering.

  Azure Bastion works with the following types of peering:

  Virtual network peering: Connect virtual networks within the same Azure region. Global virtual network peering: Connecting virtual networks across Azure regions.

• Question 17:

  You have an Azure subscription that contains eight virtual machines and the resources shown in the following table.

  

  You need to configure access for VNET1. The solution must meet the following requirements:

  1.

  The virtual machines connected to VNET1 must be able to communicate with the virtual machines connected to VNET2 by using the Microsoft backbone.

  2.

  The virtual machines connected to VNET1 must be able to access storage1, storage and Azure AD by using the Microsoft backbone. What is the minimum number of service endpoints you should add to VNET1?

  A. 1

  B. 2

  C. 3

  D. 5

  Correct Answer: B

  To meet the requirements of allowing virtual machines in VNET1 to communicate with virtual machines in VNET2 using the Microsoft backbone, as well as allowing access to Azure services such as Azure AD and Azure Storage using the Microsoft backbone, you should configure the following service endpoints in VNET1:

  - You wouldn't use service endpoints to enable communication between the VNETs. (Peering would be the likely solution for VNET to VNET communication)

  -Microsoft.Storage (For access to storage1 and storage2)

  -Microsoft.AzureActiveDirectory (For access to Azure AD)

  These service endpoints will enable traffic between the virtual machines in VNET1 and Azure Storage accounts (storage1 and storage2) and Azure Active Directory using the Microsoft backbone network.

• Question 18:

  You have an Azure subscription. The subscription contains a storage account named storage1 that has the lifecycle management rules shown in the following table.

  

  On June 1, you store a blob named File1 in the Hot access tier of storage1. What is the state of File1 on June 7?

  A. stored in the Archive access tier

  B. stored in the Hot access tier

  C. stored in the Cool access tier

  D. deleted

  Correct Answer: D

  If you define more than one action on the same blob, lifecycle management applies the least expensive action to the blob. For example, action delete is cheaper than action tierToArchive. Action tierToArchive is cheaper than action tierToCool.

  https://learn.microsoft.com/en-us/azure/storage/blobs/lifecycle-management-overview

• Question 19:

  You create an Azure Storage account.

  You plan to add 10 blob containers to the storage account.

  For one of the containers, you need to use a different key to encrypt data at rest.

  What should you do before you create the container?

  A. Generate a shared access signature (SAS).

  B. Modify the minimum TLS version.

  C. Rotate the access keys.

  D. Create an encryption scope.

  Correct Answer: D

  Encryption scopes enable you to manage encryption with a key that is scoped to a container or an individual blob. You can use encryption scopes to create secure boundaries between data that resides in the same storage account but

  belongs to different customers.

  Reference:

  https://docs.microsoft.com/en-us/azure/storage/blobs/encryption-scope-overview

• Question 20:

  You have an Azure subscription mat contains a virtual machine named VM1 and an Azure function named App1. You need to create an alert rule that will run App1 if VM1 stops. What should you create for the alert rule?

  A. a security group that has dynamic device membership

  B. an action group

  C. an application security group

  D. an application group

  Correct Answer: B