Microsoft Microsoft Certifications AZ-104 Questions & Answers

• Question 201:

  You have an Azure subscription that contains a storage account named account1.

  You plan to upload the disk files of a virtual machine to account1 from your on-premises network. The on-premises network uses a public IP address space of 131.107.1.0/24.

  You plan to use the disk files to provision an Azure virtual machine named VM1. VM1 will be attached to a virtual network named VNet1. VNet1 uses an IP address space of 192.168.0.0/24.

  You need to configure account1 to meet the following requirements:

  1.

  Ensure that you can upload the disk files to account1.

  2.

  Ensure that you can attach the disks to VM1.

  3.

  Prevent all other access to account1.

  Which two actions should you perform? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. From the Firewalls and virtual networks blade of account1, add the 131.107.1.0/24 IP address range.

  B. From the Firewalls and virtual networks blade of account1, select Selected networks.

  C. From the Firewalls and virtual networks blade of acount1, add VNet1.

  D. From the Firewalls and virtual networks blade of account1, select Allow trusted Microsoft services to access this storage account.

  E. From the Service endpoints blade of VNet1, add a service endpoint.

  Correct Answer: AB

  By default, storage accounts accept connections from clients on any network. To limit access to selected networks, you must first change the default action. Azure portal

  1.

  Navigate to the storage account you want to secure.

  2.

  Click on the settings menu called Firewalls and virtual networks.

  3.

  To deny access by default, choose to allow access from 'Selected networks'. To allow traffic from all networks, choose to allow access from 'All networks'.

  4.

  Click Save to apply your changes.

  Grant access from a Virtual Network

  Storage accounts can be configured to allow access only from specific Azure Virtual Networks. By enabling a Service Endpoint for Azure Storage within the Virtual Network, traffic is ensured an optimal route to the Azure Storage service. The

  identities of the virtual network and the subnet are also transmitted with each request.

  Reference:

  https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security

• Question 202:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a computer named Computer1 that has a point-to-site VPN connection to an Azure

  virtual network named VNet1. The point-to-site connection uses a self-signed certificate.

  From Azure, you download and install the VPN client configuration package on a computer named Computer2.

  You need to ensure that you can establish a point-to-site VPN connection to VNet1 from Computer2.

  Solution: On Computer2, you set the Startup type for the IPSec Policy Agent service to Automatic.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Instead export the client certificate from Computer1 and install the certificate on Computer2. Note: Each client computer that connects to a VNet using Point-to-Site must have a client certificate installed. You generate a client certificate from the self-signed root certificate, and then export and install the client certificate. If the client certificate is not installed, authentication fails.

  References: https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-certificates-point-to-site

• Question 203:

  You have an Azure subscription that contains the resources in the following table.

  

  VM1 and VM2 are deployed from the same template and host line-of-business applications. You configure the network security group (NSG) shown in the exhibit. (Click the Exhibit tab.)

  

  You need to prevent users of VM1 and VM2 from accessing websites on the Internet over TCP port 80. What should you do?

  A. Associate the NSG to Subnet1.

  B. Disassociate the NSG from a network interface.

  C. Change the DenyWebSites outbound security rule.

  D. Change the Port_80 inbound security rule.

  Correct Answer: A

  You can associate or dissociate a network security group from a network interface or subnet. The NSG has the appropriate rule to block users from accessing the Internet. We just need to associate it with Subnet1.

  References:

  https://docs.microsoft.com/en-us/azure/virtual-network/manage-network-security-group

• Question 204:

  You have Azure virtual machines that run Windows Server 2019 and are configured as shown in the following table.

  

  You create a public Azure DNS zone named adatum.com and a private Azure DNS zone named contoso.com.

  For controso.com, you create a virtual network link named link1 as shown in the exhibit. (Click the Exhibit tab.)

  

  You discover that VM1 can resolve names in contoso.com but cannot resolve names in adatum.com. VM1 can resolve other hosts on the Internet.

  You need to ensure that VM1 can resolve host names in adatum.com.

  What should you do?

  A. Update the DNS suffix on VM1 to be adatum.com.

  B. Create an SRV record in the contoso.com zone.

  C. Configure the name servers for adatum.com at the domain registrar.

  D. Modify the Access control (IAM) settings for link1.

  Correct Answer: C

  Adatum.com is a public DNS zone. The Internet top level domain DNS servers need to know which DNS servers to direct DNS queries for adatum.com to. You configure this by configuring the name servers for adatum.com at the domain registrar.

  Reference: https://docs.microsoft.com/en-us/azure/dns/dns-getstarted-portal

• Question 205:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have a computer named Computer1 that has a point-to-site VPN connection to an Azure virtual network named VNet1. The point-to-site connection uses a self-signed certificate.

  From Azure, you download and install the VPN client configuration package on a computer named Computer2.

  You need to ensure that you can establish a point-to-site VPN connection to VNet1 from Computer2.

  Solution: You export the client certificate from Computer1 and install the certificate on Computer2.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  Each client computer that connects to a VNet using Point-to-Site must have a client certificate installed. You generate a client certificate from the self-signed root certificate, and then export and install the client certificate. If the client certificate is not installed, authentication fails.

  References: https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-certificates-point-to-site

• Question 206:

  This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others

  might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure subscription named Subscription1 that contains the resources shown in the following table.

  

  VM1 connects to a virtual network named VNET2 by using a network interface named NIC1. You need to create a new network interface named NIC2 for VM1.

  Solution: You create NIC2 in RG1 and Central US. Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  The virtual machine you attach a network interface to and the virtual network you connect it to must exist in the same location, here West US, also referred to as a region.

  References:

  https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface

• Question 207:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have a computer named Computer1 that has a point-to-site VPN connection to an Azure virtual network named VNet1. The point-to-site connection uses a self-signed certificate.

  From Azure, you download and install the VPN client configuration package on a computer named Computer2.

  You need to ensure that you can establish a point-to-site VPN connection to VNet1 from Computer2.

  Solution: You modify the Azure Active Directory (Azure AD) authentication policies.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Instead export the client certificate from Computer1 and install the certificate on Computer2.

  Note:

  Each client computer that connects to a VNet using Point-to-Site must have a client certificate installed. You generate a client certificate from the self-signed root certificate, and then export and install the client certificate. If the client certificate

  is not installed, authentication fails.

  Reference:

  https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-certificates-point-to-site

• Question 208:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure subscription named Subscription1 that contains the resources shown in the following table.

  

  VM1 connects to a virtual network named VNET2 by using a network interface named NIC1.

  You need to create a new network interface named NIC2 for VM1.

  Solution: You create NIC2 in RG2 and Central US.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  The virtual machine you attach a network interface to and the virtual network you connect it to must exist in the same location, here West US, also referred to as a region.

  References:

  https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface

• Question 209:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure subscription named Subscription1 that contains the resources shown in the following table.

  

  VM1 connects to a virtual network named VNET2 by using a network interface named NIC1.

  You need to create a new network interface named NIC2 for VM1.

  Solution: You create NIC2 in RG2 and West US.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  The virtual machine you attach a network interface to and the virtual network you connect it to must exist in the same location, here West US, also referred to as a region.

  References:

  https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface

• Question 210:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure Directory (Azure AD) tenant named Adatum and an Azure Subscription named Subscription1. Adatum contains a group named Developers. Subscription1 contains a resource group named Dev.

  You need to provide the Developers group with the ability to create Azure logic apps in the Dev resource group.

  Solution: On Subscription1, you assign the DevTest Labs User role to the Developers group.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  DevTest Labs User role only lets you connect, start, restart, and shutdown virtual machines in your Azure DevTest Labs.

  You would need the Logic App Contributor role.

  References:

  https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

  https://docs.microsoft.com/en-us/azure/logic-apps/logic-apps-securing-a-logic-app