Microsoft Microsoft Certifications AZ-104 Questions & Answers

• Question 191:

  You have an Azure subscription that contains a resource group named TestRG.

  You use TestRG to validate an Azure deployment.

  TestRG contains the following resources:

  

  You need to delete TestRG. What should you do first?

  A. Modify the backup configurations of VM1 and modify the resource lock type of VNET1.

  B. Turn off VM1 and delete all data in Vault1.

  C. Remove the resource lock from VNET1 and delete all data in Vault1.

  D. Turn off VM1 and remove the resource lock from VNET1.

  Correct Answer: C

  You can't delete a vault that contains backup data. You must remove the delete locks before trying to delete a resource group.When you delete a resource group, all of its resources are also deleted. Deleting a resource group deletes all of its template deployments and currently stored operations. https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/delete-resource-group?tabs=azure-powershell

• Question 192:

  You have an Azure policy as shown in the following exhibit: What is the effect of the policy?

  

  A. You can create Azure SQL servers in ContosoRG1 only.

  B. You are prevented from creating Azure SQL servers anywhere in Subscription 1.

  C. You are prevented from creating Azure SQL Servers in ContosoRG1 only.

  D. You can create Azure SQL servers in any resource group within Subscription 1.

  Correct Answer: A

  You are prevented from creating Azure SQL servers anywhere in Subscription 1 with the exception of ContosoRG1 Reference: https://docs.microsoft.com/en-us/azure/governance/policy/concepts/definition-structure

• Question 193:

  You have an Azure virtual machine named VM1.

  Azure collects events from VM1.

  You are creating an alert rule in Azure Monitor to notify an administrator when an error is logged in the System event log of VM1.

  You need to specify which resource type to monitor.

  Which target resource should you monitor in the alert rule?

  A. metric alert

  B. Azure Log Analytics workspace

  C. virtual machine

  D. virtual machine extension

  Correct Answer: B

  Azure Monitor can collect data directly from your Azure virtual machines into a Log Analytics workspace for analysis of details and correlations. Installing the Log Analytics VM extension for Windows and Linux allows Azure Monitor to collect data from your Azure VMs. Azure Log Analytics workspace is also used for on-premises computers monitored by System Center Operations Manager.

  For the first step to create the new alert tule, under the Create Alert section, you are going to select your Log Analytics workspace as the resource, since this is a log based alert signal.

  Reference: https://docs.microsoft.com/en-us/windows-server/storage/storage-spaces/configure-azure-monitor https://docs.microsoft.com/en-us/azure/azure-monitor/learn/quick-collect-azurevm

• Question 194:

  You have an Azure subscription that contains a user account named User1.

  You need to ensure that User1 can assign a policy to the tenant root management group.

  What should you do?

  A. Assign the Owner role for the Azure Subscription to User1, and then modify the default conditional access policies.

  B. Assign the Owner role for the Azure subscription to User1, and then instruct User1 to configure access management for Azure resources.

  C. Assign the Global administrator role to User1, and then instruct User1 to configure access management for Azure resources.

  D. Create a new management group and delegate User1 as the owner of the new management group.

  Correct Answer: C

  No one is given default access to the root management group. Azure AD Global Administrators are the only users that can elevate themselves to gain access. Once they have access to the root management group, the global administrators can assign any Azure role to other users to manage it. Reference: https://docs.microsoft.com/en-us/azure/governance/management-groups/overview#important-facts-about-the-root-management-group https://docs.microsoft.com/en-us/azure/governance/management-groups/overview

• Question 195:

  You have an Azure Active Directory (Azure AD) tenant named contoso.onmicrosoft.com.

  The User administrator role is assigned to a user named Admin1.

  An external partner has a Microsoft account that uses the [email protected] sign in.

  Admin1 attempts to invite the external partner to sign in to the Azure AD tenant and receives the following error message: "Unable to invite user [email protected] ?Generic authorization exception."

  You need to ensure that Admin1 can invite the external partner to sign in to the Azure AD tenant.

  What should you do?

  A. From the Roles and administrators blade, assign the Security administrator role to Admin1.

  B. From the Organizational relationships blade, add an identity provider.

  C. From the Custom domain names blade, add a custom domain.

  D. From the Users blade, modify the External collaboration settings.

  Correct Answer: D

  References:

  https://techcommunity.microsoft.com/t5/Azure-Active-Directory/Generic-authorization-exception- inviting-Azure-AD-gests/td-p/274742

• Question 196:

  You have an Azure Active Directory (Azure AD) tenant named contosocloud.onmicrosoft.com.

  Your company has a public DNS zone for contoso.com.

  You add contoso.com as a custom domain name to Azure AD.

  You need to ensure that Azure can verify the domain name.

  Which type of DNS record should you create?

  A. PTR

  B. TXT or MX

  C. NSEC3

  D. RRSIG

  Correct Answer: B

  TXT or MX : Correct You can use either a TXT or MX record to verify the custom domain in the Azure AD. MX records can serve the purpose of TXT records

  

  SRV : Incorrect

  SRV records are used by various services to specify server locations. When specifying an SRV record in Azure DNS

  DNSKEY : Incorrect Choice

  This will verify that the records are originating from an authorized sender.

  NSEC : Incorrect Choice

  This is Part of DNSSEC. This is used for explicit denial-of-existence of a DNS record. It is used to prove a name does not exist.

  Reference:

  https://docs.microsoft.com/en-us/azure/dns/dns-web-sites-custom-domain https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/add-custom-domain#verify- your-custom-domain-name https://www.cloudflare.com/dns/dnssec/

  how-dnssec-works/#:~:text=DNSKEY%20%2D%20Contains%20a%20public%20signing,s)%20in%20the%20parent %20zone.

• Question 197:

  Your company has an Azure subscription named Subscription1. The company also has two on-premises servers named Server1 and Server2 that run Windows Server 2016. Server1 is configured as a DNS server that has a primary DNS zone named adatum.com.

  Adatum.com contains 1,000 DNS records.

  You manage Server1 and Subscription1 from Server2. Server2 has the following tools installed:

  1.

  The DNS Manager console

  2.

  Azure PowerShell

  3.

  Azure CLI 2.0

  You need to move the adatum.com zone to Subscription1.

  The solution must minimize administrative effort.

  What should you use?

  A. Azure PowerShell

  B. Azure CLI

  C. the Azure portal

  D. the DNS Manager console

  Correct Answer: B

  Azure DNS supports importing and exporting zone files by using the Azure command-line interface (CLI). Zone file import is not currently supported via Azure PowerShell or the Azure portal.

  References: https://docs.microsoft.com/en-us/azure/dns/dns-import-export

• Question 198:

  You have an Azure subscription.

  Users access the resources in the subscription from either home or from customer sites. From home, users must establish a point-to-site VPN to access the Azure resources. The users on the customer sites access the Azure resources by using site-to-site VPNs.

  You have a line-of-business-app named App1 that runs on several Azure virtual machine. The virtual machines run Windows Server 2016. You need to ensure that the connections to App1 are spread across all the virtual machines.

  What are two possible Azure services that you can use? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. a public load balancer

  B. Traffic Manager

  C. an Azure Content Delivery Network (CDN)

  D. an internal load balancer

  E. an Azure Application Gateway

  Correct Answer: DE

  Line-of-business apps means custom apps. Generally these are used by internal staff members of the company.

  Azure Application Gateway is a web traffic load balancer that enables you to manage traffic to your web applications.

  Internal Load Balancer provides a higher level of availability and scale by spreading incoming requests across virtual machines (VMs) within the virtual network.

  Reference:

  https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-overview https://docs.microsoft.com/en-us/azure/application-gateway/overview

• Question 199:

  You have an azure subscription that contain a virtual named VNet1. VNet1. contains four subnets named Gatesway, perimeter, NVA, and production. The NVA contain two network virtual appliance (NVAs) that will network traffic inspection

  between the perimeter subnet and the production subnet.

  You need to implement an Azure load balancer for the NVAs. The solution must meet the following requirements:

  1.

  The NVAs must run in an active-active configuration that uses automatic failover.

  2.

  The NVA must load balance traffic to two services on the Production subnet.

  3.

  The services have different IP addresses

  Which three actions should you perform? Each correct answer presents parts of the solution. NOTE: Each correct selection is worth one point.

  A. Add two load balancing rules that have HA Ports enabled and Floating IP disabled.

  B. Deploy a standard load balancer.

  C. Add a frontend IP configuration, two backend pools, and a health prob.

  D. Add a frontend IP configuration, a backend pool, and a health probe.

  E. Add two load balancing rules that have HA Ports and Floating IP enabled.

  F. Deploy a basic load balancer.

  Correct Answer: BCE

  A standard load balancer is required for the HA ports. -Two backend pools are needed as there are two services with different IP addresses. -Floating IP rule is used where backend ports are reused. Incorrect Answers:

  F: HA Ports are not available for the basic load balancer.

  References:

  https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-standard-overview

  https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-multivip-overview

  The following diagram presents a hub-and-spoke virtual network deployment.

  The spokes force- tunnel their traffic to the hub virtual network and through the NVA, before leaving the trusted space.

  The NVAs are behind an internal Standard Load Balancer with an HA ports configuration.

  All traffic can be processed and forwarded accordingly.

  When configured as show in the following diagram, an HA Ports load-balancing rule additionally provides flow symmetry for ingress and egress traffic.

  Reference : https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-overview https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-multivip-overview https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-ha-ports-overview#a-single-floating-ip-direct-server-return-ha-ports-configuration-on-an-internal-standard-load-balancer

• Question 200:

  You have an azure subscription named Subscription that contains the resource groups shown in the following table.

  

  In RG1, you create a virtual machine named VM1 in the East Asia location.

  You plan to create a virtual network named VNET1.

  You need to create VNET, and then connect VM1 to VNET1.

  What are two possible ways to achieve this goal? Each correct answer presents a complete a solution.

  NOTE: Each correct selection is worth one point.

  A. Create VNET1 in RG2, and then set East Asia as the location.

  B. Create VNET1 in a new resource group in the West US location, and then set West US as the location.

  C. Create VNET1 in RG1, and then set East Asia as the location

  D. Create VNET1 in RG1, and then set East US as the location.

  E. Create VNET1 in RG2, and then set East US as the location.

  Correct Answer: AC

  A network interface can exist in the same, or different resource group, than the virtual machine you attach it to, or the virtual network you connect it to. The virtual machine you attach a network interface to and the virtual network you connect it

  to must exist in the same location, also referred to as a region. Note, Resource groups can span multiple Regions, but VNets only can hold resources (VMs, Network Adapters) that exists in the same region.

  So in this scenario, you need to create VNET1 in any RG and set location as East Asia.

  Reference:

  https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface