Microsoft Microsoft Certifications AZ-104 Questions & Answers

• Question 411:

  You have an Azure subscription that contains the resources in the following table.

  

  To which subnets can you apply NSG1?

  A. the subnets on VNet1 only

  B. the subnets on VNet2 only

  C. the subnets on VNet3 only

  D. the subnets on VNet2. VNet2, and VNet3

  E. the subnets on VNet2 and VNet3 only

  Correct Answer: C

  All Azure resources are created in an Azure region and subscription. A resource can only be created in a virtual network that exists in the same region and subscription as the resource.

  References:

  https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-vnet-plan-design-arm

• Question 412:

  You need to deploy an Azure virtual machine scale set that contains five instances as quickly as possible. What should you do?

  A. Deploy five virtual machines. Modify the Size setting for each virtual machine.

  B. Deploy live virtual machines. Modify the Availability Zones setting for each virtual machine.

  C. Deploy one virtual machine scale set that is set to ScaleSetVM orchestration mode.

  D. Deploy one virtual machine scale set that is set to VM (virtual machines) orchestration mode.

  Correct Answer: C

  ScaleSetVM orchestration mode: Virtual machine instances added to the scale set are based on the scale set configuration model. The virtual machine instance lifecycle - creation, update, deletion - is managed by the scale set. It the current default VMSS behavior. (Scale set VMs are created in a single shot).

  VM (virtual machines) orchestration mode: Virtual machines created outside of the scale set can be explicitly added to the scale set. The orchestration mode VM will only create an empty VMSS without any instances, and you will have to manually add new VMs into it by specifying the VMSS ID during the creation of the VM. (Separately VMs are created and added to scale set later)

  Reference: https://docs.microsoft.com/en-us/azure/virtual-machine-scale-sets/orchestration-modes

• Question 413:

  You have an Azure subscription named Subscription1 that contains a virtual network named VNet1. VNet1 is in a resource group named RG1.

  Subscription1 has a user named User1. User1 has the following roles:

  1.

  Reader

  2.

  Security Admin

  3.

  Security Reader

  You need to ensure that User1 can assign the Reader role for VNet1 to other users.

  What should you do?

  A. Assign User1 the Contributor role for VNet1.

  B. Remove User from the Security Reader and Reader roles tot Subscription1.

  C. Assign User1 the Network Contributor role for VNet1.

  D. Assign User1 the User Access Administrator role for VNet1

  Correct Answer: D

  The User Access Administrator role allows you to manage user access to Azure resources.

  Reference:

  https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#user-access-administrator

• Question 414:

  You deploy an Azure Kubernetes Service (AKS) cluster named Cluster1 that uses the IP addresses shown in the following table.

  

  You need to provide internet users with access to the applications that run in Cluster1. Which IP address should you include in the DNS record for Cluster1?

  A. 172.17.7.1

  B. 131.107.2.1

  C. 192.168.10.2

  D. 10.0.10.11

  Correct Answer: B

  When any internet user will try to access the cluster which is behind a load balancer, traffic will first hit to load balancer front end IP. So in the DNS configuration you have to provide the IP address of the load balancer.

  Reference:

  https://stackoverflow.com/questions/43660490/giving-a-dns-name-to-azure-load-balancer

• Question 415:

  You have an Azure subscription that contains a resource group named RG26.

  RG26 is set to the West Europe location and is used to create temporary resources for a project. RG26 contains the resources shown in the following table.

  

  SQLDB01 is backed up to RGV1.

  When the project is complete, you attempt to delete RG26 from the Azure portal. The deletion fails.

  You need to delete RG26.

  What should you do first?

  A. Stop the backup of SQLDB01.

  B. Delete sa001.

  C. Delete VM1.

  D. StopVM1.

  Correct Answer: A

  You can't delete a vault that contains backup data. So in this case at first you have to delete the backup of 'SQLD01' before you attempt to delete the vault.

  Reference:

  https://docs.microsoft.com/en-us/azure/backup/backup-azure-delete-vault

• Question 416:

  You have an Azure subscription that contains the resources shown in the following table.

  

  You need to deploy Application1 to Cluster1. Which command should you run?

  A. az acr build

  B. az ales create

  C. kubect1 apply

  D. docker build

  Correct Answer: A

• Question 417:

  You have an Azure Active Directory (Azure AD) tenant named contosocloud.onmicrosoft.com.

  Your company has a public DNS zone for contoso.com.

  You add contoso.com as a custom domain name to Azure AD. You need to ensure that Azure can verify the domain name.

  Which type of DNS record should you create?

  A. NSEC

  B. PTR

  C. DNSKEY

  D. TXT

  Correct Answer: D

  TXT : Correct Choice

  You need to go to your hosting domain registrar and add in a TXT record.

  

  NSEC3 : Incorrect Choice

  This is Part of DNSSEC. This is used for explicit denial-of-existence of a DNS record. It is used to prove a name does not exist.

  RRSIG : Incorrect Choice

  This contains a cryptographic signature.

  DNSKEY : Incorrect Choice

  This will verify that the records are originating from an authorized sender.

  Reference:

  https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/add-custom-domain

  https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/add-custom-domain#verify-your-custom-domain-name

  https://www.cloudflare.com/dns/dnssec/how-dnssec-works/#:~:text=DNSKEY%20%2D%20Contains%20a%20public%20signing,s)%20in%20the%20parent %20zone.

• Question 418:

  You have an Azure subscription that contains a user named User1.

  You need to ensure that User1 can deploy virtual machines and manage virtual networks. The solution must use the principle of least privilege.

  Which role-based access control (RBAC) role should you assign to User1?

  A. Owner

  B. Virtual Machine Contributor

  C. Contributor

  D. Virtual Machine Administrator Login

  Correct Answer: C

  Contributor: Grants full access to manage all resources, but does not allow you to assign roles in Azure RBAC Incorrect Answers:

  A: Owner: Grants full access to manage all resources, including the ability to assign roles in Azure RBAC.

  B: Virtual Machine Contributor: Lets you manage virtual machines, but not access to them, and not the virtual network or storage account they're connected to.

  D: Virtual Machine Administrator Login: View Virtual Machines in the portal and login as administrator.

  Reference:

  https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

• Question 419:

  You have an Azure DNS zone named adatum.com. You need to delegate a subdomain named research.adatum.com to a different DNS server in Azure. What should you do?

  A. Create an PTR record named research in the adatum.com zone.

  B. Create an NS record named research in the adatum.com zone.

  C. Modify the SOA record of adatum.com.

  D. Create an A record named ".research in the adatum.com zone.

  Correct Answer: B

  You need to create a name server (NS) record for the zone. References: https://docs.microsoft.com/en-us/azure/dns/delegate-subdomain

• Question 420:

  Your company has a main office in London that contains 100 client computers.

  Three years ago, you migrated to Azure Active Directory (Azure AD).

  The company's security policy states that all personal devices and corporate-owned devices must be registered or joined to Azure AD.

  A remote user named User1 is unable to join a personal device to Azure AD from a home network.

  You verify that User1 was able to join devices to Azure AD in the past.

  You need to ensure that User1 can join the device to Azure AD.

  What should you do?

  A. From the Device settings blade, modify the Users may join devices to Azure AD setting.

  B. From the Device settings blade, modify the Maximum number of devices per user setting.

  C. Create a point-to-site VPN from the home network of User1 to Azure.

  D. Assign the User administrator role to User1.

  Correct Answer: B

  The Maximum number of devices setting enables you to select the maximum number of devices that a user can have in Azure AD. If a user reaches this quota, they will not be able to add additional devices until one or more of the existing

  devices are removed.

  Incorrect Answers:

  A: The Users may join devices to Azure AD setting enables you to select the users who can join devices to Azure AD. Options are All, Selected and None. The default is All.

  C: Azure AD Join enables users to join their devices to Active Directory from anywhere as long as they have connectivity with the Internet.

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/devices/device-management-azure-portal http://techgenix.com/pros-and-cons-azure-ad-join/