Microsoft Microsoft Certifications AZ-104 Questions & Answers

• Question 311:

  You need to create an Azure virtual machine named VM1 that requires a static private IP address configured inside the IP address space for the VNet in which the VM resides. How do you configure a static IP address for this Azure VM?

  A. After the VM has been created, create a new network interface and configure a static IP address for that network interface

  B. When creating a VM in the portal, select New next to private ip address and choose static after assigning the correct IP address

  C. When creating the VM in the portal, change the setting from dynamic to static on the networking tab under private IP address

  D. After the VM has been created, go to the network interface attached to the VM and change the IP configuration to static assignment

  Correct Answer: D

  Changing the IP configuration on the network interface will achieve the requirement.

• Question 312:

  You have an Azure subscription. You need to transfer 34TB of data from an on-premise Windows 2016 server to your Azure storage account. You need to ensure that the data transfer has zero impact on the network, preserves your existing drives and is the fastest and most secure method.

  What should be your first step?

  A. Start an Import Job via the Azure Portal

  B. Order an Azure Databox via the Azure Portal

  C. Open a ticket with Microsoft Support

  D. Prepare your hard drives using the WAImportExport tool

  Correct Answer: B

  The Microsoft Azure Data Box cloud solution lets you send terabytes of data into and out of Azure in a quick, inexpensive, and reliable way. https://docs.microsoft.com/en-us/azure/databox/data-box-overview

• Question 313:

  You manage a virtual network named VNet1 that is hosted in the West US region. Two virtual machines named VM1 and VM2, both running Windows Server, are on VNet1. You need to monitor traffic between VM1 and VM2 for a period of

  five hours.

  As a solution, you propose to create a connection monitor in Azure Network Watcher.

  Does this solution meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  The connection monitor capability in Azure Network Watcher monitors communication at a regular interval and informs you of reachability, latency, and network topology changes between the VM and the endpoint.

• Question 314:

  You have an Azure DNS zone named adatum.com.

  You need to delegate a subdomain named research.adatum.com to a different DNS server in Azure.

  What should you do?

  A. Create an NS record named research in the adatum.com zone.

  B. Create an PTR record named research in the adatum.com zone.

  C. Modify the SOA record of adatum.com.

  D. Create an A record named *.research in the adatum.com zone.

  Correct Answer: A

  You need to create a name server (NS) record for the zone.

  Reference: https://docs.microsoft.com/en-us/azure/dns/delegate-subdomain

• Question 315:

  You have an Azure subscription.

  You plan to deploy an Azure Kubernetes Service (AKS) cluster to support an app named App1. On- premises clients connect to App1 by using the IP address of the pod.

  For the AKS cluster, you need to choose a network type that will support App1.

  What should you choose?

  A. kubenet

  B. Azure Container Networking Interface (CNI)

  C. Hybrid Connection endpoints

  D. Azure Private Link

  Correct Answer: B

  With Azure CNI, every pod gets an IP address from the subnet and can be accessed directly. These IP addresses must be unique across your network space. Incorrect Answers:

  A: The kubenet networking option is the default configuration for AKS cluster creation. With kubenet, nodes get an IP address from the Azure virtual network subnet. Pods receive an IP address from a logically different address space to the Azure virtual network subnet of the nodes. Network address translation (NAT) is then configured so that the pods can reach resources on the Azure virtual network.

  C, D: AKS only supports Kubenet networking and Azure Container Networking Interface (CNI) networking

  Reference: https://docs.microsoft.com/en-us/azure/aks/concepts-network

• Question 316:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure subscription that contains the virtual machines shown in the following table.

  

  You deploy a load balancer that has the following configurations:

  1.

  Name: LB1

  2.

  Type: Internal

  3.

  SKU: Standard

  4.

  Virtual network: VNET1

  You need to ensure that you can add VM1 and VM2 to the backend pool of LB1. Solution: You disassociate the public IP address from the network interface of VM2. Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  You can only attach virtual machines that have a standard SKU public IP configuration or no public IP configuration. All IP configurations must be on the same virtual network.

  ALso, VMs do not have to be powered on when adding them to a backend pool.

  So answer should be A (Yes)

• Question 317:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an app named App1 that is installed on two Azure virtual machines named VM1 and VM2. Connections to App1 are managed by using an Azure Load Balancer.

  The effective network security configurations for VM2 are shown in the following exhibit.

  

  You discover that connections to App1 from 131.107.100.50 over TCP port 443 fail.

  You verify that the Load Balancer rules are configured correctly.

  You need to ensure that connections to App1 can be established successfully from 131.107.100.50 over TCP port 443.

  Solution: You modify the priority of the Allow_131.107.100.50 inbound security rule.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  llow_131.107.100.50 rule has a higher priority (100). The issue is not related with the priority of the rule.

• Question 318:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an app named App1 that is installed on two Azure virtual machines named VM1 and VM2. Connections to App1 are managed by using an Azure Load Balancer.

  The effective network security configurations for VM2 are shown in the following exhibit.

  

  You discover that connections to App1 from 131.107.100.50 over TCP port 443 fail.

  You verify that the Load Balancer rules are configured correctly.

  You need to ensure that connections to App1 can be established successfully from 131.107.100.50 over TCP port 443.

  Solution: You delete the BlockAllOther443 inbound security rule.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  There is a rule 65001 that allows the LB to access VMs, and the rule 200 blocks it for port 443.

  Most probably the NSG2 is shared between Vm1 and Vm2.

  The active button "Attach Network Interface" indicates VM2 is stopped, but nothing is known about VM1 which is supposed to be able to accept connections.

  Reference:

  https://fastreroute.com/azure-network-security-groups-explained/

• Question 319:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an app named App1 that is installed on two Azure virtual machines named VM1 and VM2. Connections to App1 are managed by using an Azure Load Balancer.

  The effective network security configurations for VM2 are shown in the following exhibit.

  

  You discover that connections to App1 from 131.107.100.50 over TCP port 443 fail.

  You verify that the Load Balancer rules are configured correctly.

  You need to ensure that connections to App1 can be established successfully from 131.107.100.50 over TCP port 443.

  Solution: You create an inbound security rule that denies all traffic from the 131.107.100.50 source and has a cost of 64999.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Reference: https://fastreroute.com/azure-network-security-groups-explained/

• Question 320:

  You have an Azure subscription that contains the identities shown in the following table.

  

  User1, Principal1, and Group1 are assigned the Monitoring Reader role.

  An action group named AG1 has the Email Azure Resource Manager Role notification type and is configured to email the Monitoring Reader role.

  You create an alert rule named Alert1 that uses AG1.

  You need to identity who will receive an email notification when Alert1 is triggered.

  Who should you identify?

  A. User1 and Principal1 only

  B. User1, User2, Principal1, and Principal2

  C. User1 only

  D. User1 and User2 only

  Correct Answer: C

  User1: User1 is assigned the Monitoring Reader role, so they will receive the email notification when Alert1 is triggered.

  User2: Although User2 is a user and a member of Group1, which is assigned the Monitoring Reader role, individual users take precedence over groups for email notifications. Therefore, User2 will not receive the email notification.

  Principal1: Principal1 is a Managed Identity and is not a member of any group. Therefore, Principal1 will not receive the email notification.

  Principal2: Principal2 is a Managed Identity and a member of Group1, which is assigned the Monitoring Reader role. However, individual users take precedence over groups for email notifications. Therefore, Principal2 will not receive the

  email notification.

  To summarize, only User1 will receive the email notification when Alert1 is triggered because they have the Monitoring Reader role assigned directly.

  Email will only be sent to Azure AD user members of the Monitoring Reader role. Email will not be sent to Azure AD groups or service principals.

  Reference:

  https://docs.microsoft.com/en-us/azure/azure-monitor/platform/action-groups