Microsoft Microsoft Certifications AZ-104 Questions & Answers

• Question 371:

  You have an Azure subscription.

  You activate Enterprise Mobility + Security E5 licenses for all users.

  You need the users to request approval before they can create virtual machines.

  What should you configure first?

  A. Azure Active Directory (Azure AD) conditional access policies

  B. Azure Active Directory (Azure AD) Authentication methods

  C. Azure Active Directory (Azure AD) Privileged Identity Management for the Azure resource roles

  D. Azure Active Directory (Azure AD) Privileged Identity Management for the Azure AD directory roles

  Correct Answer: C

  https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-resource-roles-assign-roles

• Question 372:

  Your company registers a domain name of contoso.com.

  You create an Azure DNS named contoso.com and then you add an A record to the zone for a host named www that has an IP address of 131.107.1.10.

  You discover that Internet hosts are unable to resolve www.contoso.com to the 131.107.1.10 IP address.

  You need to resolve the name resolution issue.

  Solution: You modify the name server at the domain registrar.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  References: https://docs.microsoft.com/en-us/azure/dns/dns-delegate-domain-azure-dns

• Question 373:

  Note: This question is part of a series of questions that present the same scenario goals. Some question sets might have more than one correct solution, while others

  ion in the series contains a unique solution that might meet the stated not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure web app named Appl. App1 runs in an Azure App Service plan named Plan1. Plan1 is associated to the Free pricing tier.

  You discover that App1 stops each day after running continuously for 60 minutes.

  You need to ensure that App1 can run continuously for the entire day.

  Solution: You add a triggered WebJob to App1.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  You need to change to Basic pricing Tier.

  Note: The Free Tier provides 60 CPU minutes / day. This explains why App1 is stops. The Basic tier has no such cap.

  References:

  https://azure.microsoft.com/en-us/pricing/details/app-service/windows/

• Question 374:

  You are the global administrator for an Azure Active Directory (Azure AD) tenant named adatum.com.

  You need to enable two-step verification for Azure users.

  What should you do?

  A. Configure a playbook in Azure AD conditional access policy.

  B. Create an Azure AD conditional access policy.

  C. Create and configure the Identify Hub.

  D. Install and configure Azure AD Connect.

  Correct Answer: B

  Conditional Access policies enforce registration, requiring unregistered users to complete registration at first sign-in, an important security consideration.

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-getstarted

• Question 375:

  You have an Azure subscription that contains three virtual networks named VNet1, VNet2, VNet3. VNet2 contains a virtual appliance named VM2 that operates as a router.

  1.

  You are configuring the virtual networks in a hub and spoke topology that uses VNet2 as the hub network.

  2.

  You plan to configure peering between VNet1 and VNet2 and between VNet2 and VNet3.

  3.

  You need to provide connectivity between VNet1 and VNet3 through VNet2.

  Which two configurations should you perform? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. On the peering connections, allow forwarded traffic.

  B. On the peering connections, allow gateway transit.

  C. Create route tables and assign the table to subnets.

  D. Create a route filter.

  E. On the peering connections, use remote gateways.

  Correct Answer: AC

  Allow gateway transit: Check this box if you have a virtual network gateway attached to this virtual network and want to allow traffic from the peered virtual network to flow through the gateway. The peered virtual network must have the Use

  remote gateways checkbox checked when setting up the peering from the other virtual network to this virtual network.

  References:

  https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-manage- peering#requirements-andconstraints

• Question 376:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You manage a virtual network named VNet1 that is hosted in the West US Azure region. VNet1 hosts two virtual machines named VM1 and VM2 that run Windows Server. You need to inspect all the network traffic from VM1 to VM2 for a period of three hours.

  Solution: From Performance Monitor, you create a Data Collector Set (DCS). Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  You should use Azure Network Watcher.

  References:

  https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-monitoring-overview

• Question 377:

  You have an Azure subscription that contains the resources shown in the following table.

  

  The Not allowed resource types Azure policy is assigned to RG1 and uses the following parameters:

  1.

  Microsoft.Network/virtualNetwork

  2.

  Microsoft.Compute/virtualMachines

  In RG1, you need to create a new virtual machine named VM2, and then connect VM2 to VNET1. What should you do first?

  A. Remove Microsoft.Network/virtualNetworks from the policy

  B. Create an Azure Resource Manager template

  C. Remove Microsoft.Compute/virtualMachines from the policy

  D. Add a subnet to VNET1

  Correct Answer: C

  The Not allowed resource types Azure policy prohibits the deployment of specified resource types.

  You specify an array of the resource types to block.

  Virtual Networks and Virtual Machines are prohibited.

  Reference:

  https://docs.microsoft.com/en-us/azure/governance/policy/samples/

• Question 378:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your company registers a domain name of contoso.com.

  You create an Azure DNS zone named contoso.com, and then you add an A record to the zone for a host named www that has an IP address of 131.107.1.10.

  You discover that Internet hosts are unable to resolve www.contoso.com to the 131.107.1.10 IP address.

  You need to resolve the name resolution issue.

  Solution: You create a PTR record for www in the contoso.com zone.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Modify the Name Server (NS) record.

  A NS record would be created automatically and you cannot modify it (but you can add to it to support co-hosting domains). You can add additional name servers to this NS record set, to support co-hosting domains with more than one DNS

  provider. You can also modify the TTL and metadata for this record set. However, you cannot remove or modify the pre-populated Azure DNS name servers.

  References:

  https://docs.microsoft.com/en-us/azure/dns/dns-delegate-domain-azure-dns

• Question 379:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You manage a virtual network named VNet1 that is hosted in the West US Azure region. VNet1 hosts two virtual machines named VM1 and VM2 that run Windows Server. You need to inspect all the network traffic from VM1 to VM2 for a period of three hours. Solution: From Azure Network Watcher, you create a packet capture. Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  https://azure.microsoft.com/en-us/updates/general-availability-azure-network-watcher-connection- monitor-inall-public-regions/

• Question 380:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You manage a virtual network named VNet1 that is hosted in the West US Azure region. VNet1 hosts two virtual machines named VM1 and VM2 that run Windows Server. You need to inspect all the network traffic from VM1 to VM2 for a period of three hours.

  Solution: From Azure Monitor, you create a metric on Network In and Network Out. Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  You should use Azure Network Watcher.

  References: https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-monitoring-overview