Microsoft Microsoft Certifications AZ-104 Questions & Answers

• Question 321:

  You have an Azure subscription named Subscription1 that contains a virtual network named VNet1. VNet1 is in a resource group named RG1. Subscription1 has a user named User1. User1 has the following roles:

  1.

  Reader

  2.

  Security Admin

  3.

  Security Reader

  You need to ensure that User1 can assign the Reader role for VNet1 to other users.

  What should you do?

  A. Remove User1 from the Security Reader role for Subscription1. Assign User1 the Contributor role for RG1.

  B. Assign User1 the Owner role for VNet1.

  C. Remove User1 from the Security Reader and Reader roles for Subscription1.

  D. Assign User1 the Network Contributor role for RG1.

  Correct Answer: B

  Has full access to all resources including the right to delegate access to others.

  Note:

  There are several versions of this question in the exam. The question can have other incorrect answer options, including the following:

  1.

  Name Server (NS)

  2.

  Assign User1 the Contributor role for VNet1.

  3.

  Remove User1 from the Security Reader and Reader roles for Subscription1. Assign User1 the Contributor role for Subscription1.

  Reference: https://docs.microsoft.com/en-us/azure/role-based-access-control/overview

• Question 322:

  You have an Azure subscription named Subscription1 that contains an Azure virtual machine named VM1. VM1 is in a resource group named RG1.

  VM1 runs services that will be used to deploy resources to RG1.

  You need to ensure that a service running on VM1 can manage the resources in RG1 by using the identity of VM1.

  What should you do first?

  A. From the Azure portal, modify the Managed Identity settings of VM1

  B. From the Azure portal, modify the Access control (IAM) settings of RG1

  C. From the Azure portal, modify the Access control (IAM) settings of VM1

  D. From the Azure portal, modify the Policies settings of RG1

  Correct Answer: A

  Managed identities for Azure resources provides Azure services with an automatically managed identity in Azure Active Directory. You can use this identity to authenticate to any service that supports Azure AD authentication, without having

  credentials in your code.

  You can enable and disable the system-assigned managed identity for VM using the Azure portal.

  Reference:

  https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/qs-configure-portal-windows-vm

• Question 323:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure subscription that contains the virtual machines shown in the following table.

  

  You deploy a load balancer that has the following configurations:

  1.

  Name: LB1

  2.

  Type: Internal

  3.

  SKU: Standard

  4.

  Virtual network: VNET1

  You need to ensure that you can add VM1 and VM2 to the backend pool of LB1.

  Solution: You create two Standard SKU public IP addresses and associate a Standard SKU public IP address to the network interface of each virtual machine.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  You can only attach virtual machines that are in the same location and on the same virtual network as the LB. Virtual machines must have a standard SKU public IP or no public IP. The LB needs to be a standard SKU to accept individual VMs

  outside an availability set or vmss. VMs do not need to have public IPs but if they do have them they have to be standard SKU. Vms can only be from a single network. When they don't have a public IP they are assigned an ephemeral IP.

  Also, when adding them to a backend pool, it doesn't matter in which status are the VMs.

  Note: Load balancer and the public IP address SKU must match when you use them with public IP addresses.

• Question 324:

  You have an Azure virtual machine named VM1.

  The network interface for VM1 is configured as shown in the exhibit. (Click the Exhibit tab.)

  You deploy a web server on VM1, and then created a secure website that is accessible by using the HTTPS protocol. VM1 is used as a web server only.

  You need to ensure that users can connect to the website from the internet.

  What should you do?

  A. Modify the action of Rule1.

  B. Change the priority of Rule6 to 100.

  C. For Rule4, change the protocol from UDP to Any.

  D. For Rule5, change the Action to Allow and change the priority to 401.

  Correct Answer: D

• Question 325:

  You have an Azure subscription that contains the identifies shown in the following table.

  

  User1, Principle, and Group1 are assigned the Monitoring Reader role.

  An action an alert rule named Alert1 that uses AG1.

  You need to identify who will receive an email notification when Alert1 is triggered.

  Who should you identity?

  A. User1, User2, Principle, and Principle2

  B. User1 and Principle only

  C. User1 only

  D. User1 and User2 only

  Correct Answer: C

  Email will only be sent to Azure AD user members of the Monitoring Reader role. Email will not be sent to Azure AD groups or service principals.

  Reference: https://docs.microsoft.com/en-us/azure/azure-monitor/platform/action-groups

• Question 326:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure subscription that contains the virtual machines shown in the following table.

  

  You deploy a load balancer that has the following configurations:

  1.

  Name: LB1

  2.

  Type: Internal

  3.

  SKU: Standard

  4.

  Virtual network: VNET1

  You need to ensure that you can add VM1 and VM2 to the backend pool of LB1.

  Solution: You disassociate the public IP address from the network interface of VM2.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: A

• Question 327:

  You have an Azure subscription.

  You plan to deploy an Azure Kubernetes Services (AKS) cluster to support an app named APP1. On-premises clients connect to App1 by using the IP address of the pod.

  For the AKS cluster, you need to choose a network type that will support App1.

  What should you choose?

  A. Azure Private Link

  B. Hybrid Connection endpoints

  C. Kubened

  D. Azure Container Networking Interface (CNI)

  Correct Answer: D

  With Azure CNI, every pod gets an IP address from the subnet and can be accessed directly. These IP addresses must be unique across your network space. https://docs.microsoft.com/en-us/azure/aks/concepts-network#azure-virtual-networks

• Question 328:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure subscription that contains the virtual machines shown in the following table.

  

  You deploy a load balancer that has the following configurations:

  1.

  Name: LB1

  2.

  Type: Internal

  3.

  SKU: Standard

  4.

  Virtual network: VNET1

  You need to ensure that you can add VM1 and VM2 to the backend pool of LB1.

  Solution: You disassociate the public IP address from the network interface of VM2.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  You can only attach virtual machines in the same region and that have a standard SKU public IP configuration or no public IP configuration. All IP configurations must be on the same virtual network.

• Question 329:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure subscription that contains the virtual machines shown in the following table.

  

  You deploy a load balancer that has the following configurations:

  1.

  Name: LB1

  2.

  Type: Internal

  3.

  SKU: Standard

  4.

  Virtual network: VNET1

  You need to ensure that you can add VM1 and VM2 to the backend pool of LB1.

  Solution: You create a Basic SKU public IP address, associate the address to the network interface of VM1, and then start VM1.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  You can only attach virtual machines that are in the same location and on the same virtual network as the LB. Virtual machines must have a standard SKU public IP or no public IP.

  The LB needs to be a standard SKU to accept individual VMs outside an availability set or vmss. VMs do not need to have public IPs but if they do have them they have to be standard SKU. Vms can only be from a single network. When they

  don't have a public IP they are assigned an ephemeral IP.

  Also, when adding them to a backend pool, it doesn't matter in which status are the VMs.

  Note: Load balancer and the public IP address SKU must match when you use them with public IP addresses.

  Reference:

  https://docs.microsoft.com/en-us/azure/load-balancer/backend-pool-management

• Question 330:

  You plan to move a distributed on-premises app named App1 to an Azure subscription.

  After the planned move, App1 will be hosted on several Azure virtual machines.

  You need to ensure that App1 always runs on at least eight virtual machines during planned Azure maintenance.

  What should you create?

  A. one virtual machine scale set that has 10 virtual machines instances

  B. one Availability Set that has three fault domains and one update domain

  C. one Availability Set that has 10 update domains and one fault domain

  D. one virtual machine scale set that has 12 virtual machines instances

  Correct Answer: A

  VM Scale Set consists of a set of identically configured VMs. Availability Set consists of a set of discrete VMs.

  No more than 20% of the Scale Set upgrading at any time, then 2 machines out of 10 will have maintenance, the 8 remaining VMs will be up.

  Virtual machine scale sets are created with five fault domains by default in Azure regions with no zones. For the regions that support zonal deployment of virtual machine scale sets and this option is selected, the default value of the fault domain count is 1 for each of the zones. FD=1 in this case implies that the VM instances belonging to the scale set will be spread across many racks on a best effort basis.

  Reference: https://docs.microsoft.com/en-us/azure/virtual-machines/manage-availability https://docs.microsoft.com/en-us/learn/modules/build-app-with-scale-sets/2-features-benefits-virtual-machine-scale-sets https://docs.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-automatic-upgrade