Microsoft Microsoft Certifications AZ-104 Questions & Answers

• Question 341:

  You deploy an Azure Application Gateway.

  You need to ensure that all the traffic requesting https://adatum.com/internal resources is directed to an internal server pool and all the traffic requesting https://adatum.com/external resources is directed to an external server pool.

  What should you configure on the Application Gateway?

  A. URL path-based routing

  B. multi-site listeners

  C. basic routing

  D. SSL termination

  Correct Answer: A

  URL Path Based Routing allows you to route traffic to back-end server pools based on URL Paths of the request.

  In the question there are two different path from where the traffic is getting generated as below https://adatum.com/internal https://adatum.com/external So in this case we can use URL path-based routing feature of Application Gateway.

  

  Reference: https://docs.microsoft.com/en-us/azure/application-gateway/url-route-overview

• Question 342:

  You have a Microsoft SQL Server Always On availability group on Azure virtual machines. You need to configure an Azure internal load balancer as a listener for the availability group. What should you do?

  A. Enable Floating IP.

  B. Set Session persistence to Client IP and protocol.

  C. Set Session persistence to Client IP.

  D. Create an HTTP health probe on port 1433.

  Correct Answer: A

  References:

  https://docs.microsoft.com/en-us/azure/virtual-machines/windows/sql/virtual-machines-windows- portal-sql-alwayson-int-listener

• Question 343:

  You are troubleshooting a performance issue for an Azure Application Gateway. You need to compare the total requests to the failed requests during the past six hours. What should you use?

  A. Metrics in Application Gateway

  B. Diagnostics logs in Application Gateway

  C. NSG flow logs in Azure Network Watcher

  D. Connection monitor in Azure Network Watcher

  Correct Answer: A

  Application Gateway currently has seven metrics to view performance counters. Metrics are a feature for certain Azure resources where you can view performance counters in the portal. For Application Gateway, the following metrics are available:

  1.

  Total Requests

  2.

  Failed Requests

  3.

  Current Connections

  4.

  Healthy Host Count

  5.

  Response Status

  6.

  Throughput

  7.

  Unhealthy Host count You can filter on a per backend pool basis to show healthy/unhealthy hosts in a specific backend pool

  References: https://docs.microsoft.com/en-us/azure/application-gateway/application-gatewaydiagnostics# Metrics

• Question 344:

  You have 100 Azure subscriptions. All the subscriptions are associated to the same Azure Active Directory (Azure AD) tenant named contoso.com.

  You are a global administrator.

  You plan to create a report that lists all the resources across all the subscriptions.

  You need to ensure that you can view all the resources in all the subscriptions.

  What should you do?

  A. From the Azure portal, modify the profile settings of your account.

  B. From Windows PowerShell, run the Add-AzureADAdministrativeUnitMember cmdlet.

  C. From Windows PowerShell, run the New-AzureADUserAppRoleAssignment cmdlet.

  D. From the Azure portal, modify the properties of the Azure AD tenant.

  Correct Answer: C

  The New-AzureADUserAppRoleAssignment cmdlet assigns a user to an application role in Azure Active Directory (AD). Use it for the application report.

  References:

  https://docs.microsoft.com/en-us/powershell/module/azuread/new- azureaduserapproleassignment?view=azureadps-2.0

• Question 345:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure web app named Appl. App1 runs in an Azure App Service plan named Plan1. Plan1 is associated to the Free pricing tier.

  You discover that App1 stops each day after running continuously for 60 minutes.

  You need to ensure that App1 can run continuously for the entire day.

  Solution: You change the pricing tier of Plan1 to Basic.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  The Free Tier provides 60 CPU minutes / day. This explains why App1 is stops. The Basic tier has no such cap.

  References:

  https://azure.microsoft.com/en-us/pricing/details/app-service/windows/

• Question 346:

  You have an Azure App Service plan named AdatumASP1 that uses the P2v2 pricing tier. AdatumASP1 hosts Ml Azure web app named adatumwebapp1. You need to delegate the management of adatumwebapp1 to a group named Devs. Devs must be able to perform the following tasks:

  1.

  Add deployment slots.

  2.

  View the configuration of AdatumASP1.

  3.

  Modify the role assignment for adatumwebapp1.

  Which role should you assign to the Devs group?

  A. Owner

  B. Contributor

  C. Web Plan Contributor

  D. Website Contributor

  Correct Answer: A

  Owner : Correct Choice

  The Owner role lets you manage everything, including access to resources.

  Contributor : Incorrect Choice

  With contributor role you can Add deployment slots and View the configuration of App service plan but you can't Modify the role assignment. For this you need User Access Administrator or Owner role. So this is incorrect.

  Web Plan Contributor : Incorrect Choice

  The Web Plan Contributor role lets you manage the web plans for websites, but not access to them.

  So this option is incorrect.

  Website Contributor : Incorrect Choice

  The Website Contributor role lets you manage websites (not web plans), but not access to them. So this is incorrect option.

  Note:

  As per least privilege principle it is not advisable to provide owner role to any group, rather you should create custom RBAC role with custom policy and use that role for this operation. However as this option is not available here so only option

  to go with owner role.

  References:

  https://docs.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal

  https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

• Question 347:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your company registers a domain name of contoso.com.

  You create an Azure DNS zone named contoso.com, and then you add an A record to the zone for a host named www that has an IP address of 131.107.1.10.

  You discover that Internet hosts are unable to resolve www.contoso.com to the 131.107.1.10 IP address.

  You need to resolve the name resolution issue.

  Solution: You add an NS record to the contoso.com Azure DNS zone.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Before you can delegate your DNS zone to Azure DNS, you need to know the name servers for your zone.

  The NS record set contains the names of the Azure DNS name servers assigned to the zone.

  References:

  https://docs.microsoft.com/en-us/azure/dns/dns-delegate-domain-azure-dns

• Question 348:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your company registers a domain name of contoso.com.

  You create an Azure DNS zone named contoso.com, and then you add an A record to the zone for a host named www that has an IP address of 131.107.1.10.

  You discover that Internet hosts are unable to resolve www.contoso.com to the 131.107.1.10 IP address.

  You need to resolve the name resolution issue.

  Solution: You modify the SOA record in the contoso.com zone.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Modify the NS record, not the SOA record.

  Note: The SOA record stores information about the name of the server that supplied the data for the zone; the administrator of the zone; the current version of the data file; the number of seconds a secondary name server should wait before

  checking for updates; the number of seconds a secondary name server should wait before retrying a failed zone transfer; the maximum number of seconds that a secondary name server can use data before it must either be refreshed or

  expire; and a default number of seconds for the time-to live file on resource records.

  References:

  https://searchnetworking.techtarget.com/definition/start-of-authority-record

• Question 349:

  You have a service deployed to a Kubernetes cluster.

  Another application needs to access the service via the private IP address of the pod.

  Which of the following would you define as the networking type for the cluster to meet this requirement?

  A. Kubenet

  B. Azure container networking plugin

  C. Service Endpoints

  D. Network security groups

  Correct Answer: B

  Azure container networking plugin : Correct Choice

  With the Azure container networking plugin , every pod gets an IP address allocated.

  With Azure CNI, every pod gets an IP address from the subnet and can be accessed directly. These IP addresses must be unique across your network space, and must be planned in advance. Each node has a configuration parameter for the

  maximum number of pods that it supports. The equivalent number of IP addresses per node are then reserved up front for that node. This approach requires more planning, as can otherwise lead to IP address exhaustion or the need to

  rebuild clusters in a larger subnet as your application demands grow.

  Nodes use the Azure Container Networking Interface (CNI) Kubernetes plugin.

  Kubenet : Incorrect Choice

  The kubenet networking option is the default configuration for AKS cluster creation. With kubenet, nodes get an IP address from the Azure virtual network subnet. Pods receive an IP address from a logically different address space to the

  Azure virtual network subnet of the nodes.

  Service Endpoints : Incorrect Choice

  Capabilities like service endpoints or UDRs are supported with both kubenet and Azure CNI, the support policies for AKS define what changes you can make. For example:

  If you manually create the virtual network resources for an AKS cluster, you're supported when configuring your own UDRs or service endpoints. If the Azure platform automatically creates the virtual network resources for your AKS cluster, it

  isn't supported to manually change those AKS-managed resources to configure your own UDRs or service endpoints.

  Network security groups : Incorrect Choice

  A network security group filters traffic for VMs, such as the AKS nodes. As you create Services, such as a LoadBalancer, the Azure platform automatically configures any network security group rules that are needed.

  Reference:

  https://docs.microsoft.com/en-us/azure/aks/concepts-network

• Question 350:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your company registers a domain name of contoso.com.

  You create an Azure DNS zone named contoso.com, and then you add an A record to the zone for a host named www that has an IP address of 131.107.1.10.

  You discover that Internet hosts are unable to resolve www.contoso.com to the 131.107.1.10 IP address.

  You need to resolve the name resolution issue.

  Solution: You modify the name servers at the domain registrar.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  Modify the Name Server (NS) record.

  References:

  https://docs.microsoft.com/en-us/azure/dns/dns-delegate-domain-azure-dns