Microsoft Microsoft Certifications AZ-104 Questions & Answers

• Question 231:

  You have an Azure subscription named Subscription1 and two Azure Active Directory (Azure AD) tenants named Tenant1 and Tenant2.

  Subscription1 is associated to Tenant1. Multi-factor authentication (MFA) is enabled for all the users in Tenant1.

  You need to enable MFA for the users in Tenant2. The solution must maintain MFA for Tenant1.

  What should you do first?

  A. Change the directory for Subscription1.

  B. Configure the MFA Server setting in Tenant1.

  C. Create and link a subscription to Tenant2.

  D. Transfer the administration of Subscription1 to a global administrator of Tenant2.

  Correct Answer: C

• Question 232:

  You set the multi-factor authentication status for a user named [email protected] to Enabled. Admin1 accesses the Azure portal by using a web browser. Which additional security verifications can Admin1 use when accessing the Azure portal?

  A. a phone call, a text message that contains a verification code, and a notification or a verification code sent from the Microsoft Authenticator app

  B. an app password, a text message that contains a verification code, and a notification sent from the Microsoft Authenticator app

  C. an app password, a text message that contains a verification code, and a verification code sent from the Microsoft Authenticator app

  D. a phone call, an email message that contains a verification code, and a text message that contains an app password

  Correct Answer: A

• Question 233:

  You have a Microsoft 365 subscription and a hybrid deployment of Azure Active Directory (Azure AD).

  User identities and password hashes are synced.

  You have a user account named User1.

  From Active Directory, you select the User must change password at next logon account option for User1. What will occur if User1 attempts to sigh in to myapps.microsoft.com?

  A. User1 will be prompted for a password change.

  B. User1 will sign in by using the old password.

  C. User1 will be prevented from signing in.

  Correct Answer: C

  Troubleshoot password synchronization Some users can't sign in to Office 365, Azure, or Microsoft Intune In this scenario, passwords of most users appear to be syncing. However, there are some users whose passwords appear not to sync. The following are scenarios in which a user cannot sign in to a Microsoft cloud service such as Office 365, Azure, or Intune. They include information about how to troubleshoot each scenario. Scenario 1: The "User must change password at next logon" check box is selected for the user's account To resolve this issue, follow these steps:

  1.

  Do one of the following:

  In the user account properties in Active Directory Users and Computers, clear the User must change password at next logon check box.

  Have the user change their on-premises user account password.

  2.

  Wait a few minutes for the change to sync between the on-premises Active Directory Domain Services (ADDS) and Azure AD.

  References:

  https://support.microsoft.com/en-us/help/2855271/how-to-troubleshoot-password-synchronization-when- using-an-azure-ad-sy

• Question 234:

  You have an Azure subscription named Subscription1. Subscription1 contains the resource groups in the following table.

  RG1 has a web app named WebApp1. WebApp1 is located in West Europe. You move WebApp1 to RG2.

  What is the effect of the move?

  A. The App Serviceplan for WebApp1remains in WestEurope. Policy2applies to WebApp1.

  B. The App Service plan for WebApp1 moves to North Europe. Policy2 applies to WebApp1.

  C. The App Serviceplan for WebApp1remains in WestEurope. Policy1applies to WebApp1.

  D. The App Service plan for WebApp1 moves to North Europe. Policy1 applies to WebApp1.

  Correct Answer: A

  You can move an app to another App Service plan, as long as the source plan and the target plan are in the same resource group and geographical region. The region in which your app runs is the region of the App Service plan it's in.

  However, you cannot change an App Service plan's region.

  Reference:

  https://docs.microsoft.com/en-us/azure/app-service/app-service-plan-manage

• Question 235:

  You have an Azure subscription. All users are enabled for multi-factor authentication (MFA). You need to ensure that the users can lock out their own account if they receive an unsolicited MFA request from Azure. Which MFA settings should you configure?

  A. Block/unblock users

  B. Providers

  C. Notifications

  D. Fraud alert

  Correct Answer: D

  Configure the fraud alert feature so that your users can report fraudulent attempts to access their resources.

  Users can report fraud attempts by using the mobile app or through their phone.

  Configuration options include:

  Block user when fraud is reported: If a user reports fraud, their account is blocked for 90 days or until an administrator unblocks their account. An administrator can review sign-ins by using the sign-in report, and take appropriate action to

  prevent future fraud. An administrator can then unblock the user's account.

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-mfasettings#fraud-alert

• Question 236:

  You have a general purpose v1 storage account named storageaccount1 that has a private container named container1. You need to allow read access to the data inside container1, but only within a 14 day window. How do you accomplish this?

  A. Create a stored access policy

  B. Create a service SAS

  C. Create a shared access signatures

  D. Upgrade the storage account to general purpose v2

  Correct Answer: AC

  A Stored Access Policy allows granular control over a single storage container using a Shared Access Signature (SAS).

  A Shared Access Signature (SAS) allows you to have granular control over your storage account, including access to only certain services (i.e. Azure Blobs) and permitting only read, write, delete, list, add, or create access.

• Question 237:

  You have an Azure subscription named Subscription1 that contains an Azure Log Analytics workspace named Workspace1.

  You need to view the error events from a table named Event.

  Which query should you run in Workspace1?

  A. Get-EventEvent|where{$_.EventType=="error"}

  B. search in (Event)"error"

  C. select * from Event where EventType == "error"

  D. searchin(Event)*|whereEventType-eq"error"

  Correct Answer: B

  To search a term in a specific table, add the table-name just after the search operator Note:

  There are several versions of this question in the exam. The question has two possible correct answers:

  1.

  Event | search "error"

  2.

  Event | where EventType == "error"

  3.

  search in (Event) "error"

  Other incorrect answer options you may see on the exam include the following:

  1.

  Get-Event Event | where {$_.EventTye "eq "error"}

  2.

  Event | where EventType is "error"

  3.

  search in (Event) * | where EventType "eq "error"

  4.

  select*fromEventwhereEventTypeis"error"

  Reference:

  https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/search-queries https://docs.microsoft.com/ en-us/azure/azure-monitor/log- query/get-started-portal https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/

  searchoperator? pivots=azuredataexplorer

• Question 238:

  You are configuring Azure Active Directory (Azure AD) authentication for an Azure Storage account named storage1.

  You need to ensure that the members of a group named Group1 can upload files by using the Azure portal. The solution must use the principle of least privilege.

  Which two roles should you configure for storage1? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point

  A. Reader

  B. Storage Blob Data Contributor

  C. Storage Account Contributor

  D. Storage Blob Data Reader

  E. Contributor

  Correct Answer: AB

  To access blob data in the Azure portal with Azure AD credentials, a user must have the following role assignments:

  1.

  A data access role, such as Storage Blob Data Reader or Storage Blob Data Contributor

  2.

  The Azure Resource Manager Reader role, at a minimum

  The Reader role is an Azure Resource Manager role that permits users to view storage account resources, but not modify them. It does not provide read permissions to data in Azure Storage, but only to account management resources. The

  Reader role is necessary so that users can navigate to blob containers in the Azure portal.

  Note: in order from least to greatest permissions:

  1.

  The Reader and Data Access role

  2.

  The Storage Account Contributor role

  3.

  The Azure Resource Manager Contributor role

  4.

  The Azure Resource Manager Owner role

  Reference: https://docs.microsoft.com/en-us/azure/storage/blobs/assign-azure-role-data-access

• Question 239:

  You plan to deploy route-based Site-to-Site VPN connections between several on-premises locations and an Azure virtual network.

  Which tunneling protocol should you use?

  A. L2TP

  B. |KEv2

  C. PPTP

  D. IKEv1

  Correct Answer: B

  A Site-to-Site (S2S) VPN gateway connection is used to connect your on-premises network to an Azure virtual network over an IPsec/IKE (IKEv1 or IKEv2) VPN tunnel.

  IKEv2 supports 10 S2S connections, while IKEv1 only supports 1.

  Reference:

  https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-site-to-site-classic-portal

  https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-connect-multiple-policybased-rm-ps

• Question 240:

  You have an Azure web app named Appt.

  You need to monitor the availability of App1 by using a multi-step web test.

  What should you use in Azure Monitor?

  A. Azure Application Insights

  B. the Diagnostic settings

  C. metrics

  D. Azure Service Health

  Correct Answer: A

  Upload the web test

  1.

  In the Application Insights portal on the Availability pane select Add Classic test, then select Multi-step as the SKU.

  2.

  Upload your multi-step web test.

  3.

  Set the test locations, frequency, and alert parameters.

  4.

  Select Create.

  Reference: https://docs.microsoft.com/en-us/azure/azure-monitor/app/availability-multistep