Microsoft Microsoft Certifications AZ-104 Questions & Answers

• Question 211:

  You have an Azure Active Directory (Azure AD) tenant named contoso.com.

  You have a CSV file that contains the names and email addresses of 500 external users.

  You need to create a guest user account in contoso.com for each of the 500 external users.

  Solution: You create a Power Shell script that runs the New-AZureADUser cmdlet for each user.

  Does this meet the goal?

  A. Yes

  B. NO

  Correct Answer: B

• Question 212:

  You have an Azure subscription that contains a storage account named storage1.

  The storage1 account contains a file share named share1.

  The subscription is linked to a hybrid Azure Active Directory (Azure AD) tenant that contains a security group named Group1.

  You need to gram Group! the Storage File Data SMB Share Elevated Contributor role for share1.

  What should you do first?

  A. Enable Active Directory Domain Service (ADDS) authentication for storage1.

  B. Grant share-level permissions by using File Explorer.

  C. Mount share! by using File Explorer.

  D. Create a private endpoint.

  Correct Answer: A

• Question 213:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure Directory (Azure AD) tenant named Adatum and an Azure Subscription named Subscription1. Adatum contains a group named Developers. Subscription1 contains a resource group named Dev.

  You need to provide the Developers group with the ability to create Azure logic apps in the Dev resource group.

  Solution: On Dev, you assign the Contributor role to the Developers group.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  The Contributor role can manage all resources (and add resources) in a Resource Group.

  Reference:

  https://docs.microsoft.com/en-us/azure/role-based-access-control/overview

• Question 214:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure Active Directory (Azure AD) tenant named Adatum and an Azure Subscription named Subscription1. Adatum contains a group named Developers. Subscription1 contains a resource group named Dev.

  You need to provide the Developers group with the ability to create Azure logic apps in the Dev resource group.

  Solution: On Dev, you assign the Logic App Contributor role to the Developers group.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  The Logic App Contributor role lets you manage logic app, but not access to them. It provides access to view, edit, and update a logic app.

  References:

  https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

  https://docs.microsoft.com/en-us/azure/logic-apps/logic-apps-securing-a-logic-app

• Question 215:

  Your company deploys several virtual machines on-premises and to Azure. ExpressRoute is deployed and configured for on-premises to Azure connectivity. Several virtual machines exhibit network connectivity issues. You need to analyze

  the network traffic to identify whether packets are being allowed or denied to the virtual machines.

  Solution: Use Azure Advisor to analyze the network traffic.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Reference: https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-ip-flow-verify- overview

• Question 216:

  You have an Azure Active Directory (Azure AD) tenant named adatum.com that contains the users shown in the following table.

  

  Adatum.com has the following configurations:

  Users may join devices to Azure AD is set to User1.

  Additional local administrators on Azure AD joined devices is set to None.

  You deploy Windows 10 to a computer named Computer. User1 joins Computer1 to adatum.com.

  You need to identify which users are added to the local Administrators group on Computer1.

  A. User1 only

  B. User1, User2, and User3 only

  C. User1 and User2 only

  D. User1, User2, User3, and User4

  E. User2 only

  Correct Answer: C

  Users may join devices to Azure AD - This setting enables you to select the users who can register their devices as Azure AD joined devices. The default is All.

  Additional local administrators on Azure AD joined devices - You can select the users that are granted local administrator rights on a device. Users added here are added to the Device Administrators role in Azure AD. Global administrators, here User2, in Azure AD and device owners are granted local administrator rights by default.

  References: https://docs.microsoft.com/en-us/azure/active-directory/devices/device-management-azure-portal

• Question 217:

  You have an Azure Active Directory (Azure AD) tenant named contoso.com. You have a CSV file that contains the names and email addresses of 500 external users.

  You need to create a quest user account in contoso.com for each of the 500 external users.

  Solution: from Azure AD in the Azure portal, you use the Bulk create user operation.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Instead use the New-AzureADMSInvitation cmdlet which is used to invite a new external user to your directory.

  Reference:

  https://docs.microsoft.com/en-us/powershell/module/azuread/new-azureadmsinvitation

• Question 218:

  You have an Azure App Services web app named App1.

  You plan to deploy App1 by using Web Deploy.

  You need to ensure that the developers of App1 can use their Azure Active Directory (Azure AD) credentials to deploy content to App1. The solution must use the principle of least privilege.

  What should you do?

  A. Configure app-level credentials for FTPS.

  B. Assign The Website Contributor role to the developers.

  C. Assign the Owner role to the developers.

  D. Configure user-level credentials for FTPS.

  Correct Answer: B

  https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#website-contributor Microsoft.Resources/deployments/* - Create and manage a deployment

• Question 219:

  You have an Azure subscription that contains a storage account named storageacct1234 and two users named User1 and User2. You assign User1 the roles shown in the following exhibit.

  

  Which two actions can User1 perform? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

  A. Modify the firewall of storageacct1234.

  B. View blob data in storageacct1234.

  C. View file shares in storageacct1234.

  D. Upload blob data to storageacct1234.

  E. Assign roles to User2 for storageacct1234.

  Correct Answer: BD

  For example, if you assign the Storage Blob Data Contributor role to user Mary at the level of a container named sample-container, then Mary is granted read, write, and delete access to all of the blobs in that container. However, if Mary wants to view a blob in the Azure portal, then the Storage Blob Data Contributor role by itself will not provide sufficient permissions to navigate through the portal to the blob in order to view it. The additional permissions are required to navigate through the portal and view the other resources that are visible there.

• Question 220:

  You develop the following Azure Resource Manager (ARM) template to create a resource group and deploy an Azure Storage account to the resource group.

  

  Which cmdtet should you run to deploy the template?

  A. New-AzResourceGroupDeployment

  B. New-AzDeployment

  C. New-AzResource

  D. New-AzTenantDeploynent

  Correct Answer: B

  New-AzResource

  creates an Azure resource, such as a website, Azure SQL Database server, or Azure SQL Database, in a resource group.

  Reference:

  https://learn.microsoft.com/en-us/powershell/module/az.resources/new-azresource