Microsoft Microsoft Certifications AZ-104 Questions & Answers

• Question 431:

  You have an Azure Active Directory (Azure AD) tenant that syncs to on-premises Active Directory and contains the users shown in the following table.

  

  You create a group named Group1 and add User1 to the group. You need to configure the ownership of Group 1. Which users can you add as owners of Group1?

  A. East US, West Europe, and North Europe

  B. East US and West Europe only

  C. East US only

  D. East US and North Europe only

  Correct Answer: C

  Before creating a network interface, you must have an existing virtual network in the same location and subscription you create a network interface in. If you try to create a NIC on a location that does not have any Vnets you will get the following error: "The currently selected subscription and location lack any existing virtual networks. Create a virtual network first."

  Reference: https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface

• Question 432:

  You have the Azure virtual networks shown in the following table.

  

  To which virtual networks can you establish a peering connection from VNet1?

  A. VNet2 and VNet3 only

  B. VNet2 only

  C. VNet3 and VNet4 only

  D. VNet2, VNet3, and VNet4

  Correct Answer: C

  You can connect virtual networks to each other with virtual network peering. These virtual networks can be in the same region or different regions (also known as Global VNet peering).

  Once virtual networks are peered, resources in both virtual networks are able to communicate with each other, with the same latency and bandwidth as if the resources were in the same virtual network. Global VNet Peering is now generally

  available in all Azure public regions, excluding the China, Germany, and Azure Government regions.

  The address space is the most critical configuration for a VNet in Azure. This is the IP range for the entire network that will be divided into subnets.

  The address space can almost be any IP range that you wish (public or private).

  You can add multiple address spaces to a VNet.

  To ensure this VNet can be connected to other networks, the address space should never overlap with any other networks in your environment. If a VNet has an address space that overlaps with another Azure VNet or on- premises network,

  the networks cannot be connected, as the routing of traffic will not work properly.

  References:

  https://docs.microsoft.com/en-us/azure/virtual-network/tutorial-connect-virtual-networks-portal

  https://docs.microsoft.com/en-us/azure/virtual-network/tutorial-connect-virtual-networks-portal

  https://azure.microsoft.com/ en-in/updates/general-availability-global-vnet-peering/#:~:text=Global%20VNet%20Peering%20is%20now,transit%20over%20the%20public%20int ernet.

  https://www.microsoftpressstore.com/articles/article.aspx?p=2873369

• Question 433:

  You have an Azure virtual machine named VM1.

  The network interface for VM1 is configured as shown in the exhibit. (Click the Exhibit tab.)

  

  You deploy a web server on VM1, and then create a secure website that is accessible by using the HTTPS protocol. VM1 is used as a web server only.

  You need to ensure that users can connect to the website from the Internet.

  What should you do?

  A. Create a new inbound rule that allows TCP protocol 443 and configure the protocol to have a priority of 501.

  B. For Rule5, change the Action to Allow and change the priority to 401.

  C. Delete Rule1.

  D. Modify the protocol of Rule4.

  Correct Answer: B

  Rule 2 is blocking HTTPS access (port 443) and has a priority of 500. Changing Rule 5 (ports 50-5000) and giving it a lower priority number will allow access on port 443. Note: Rules are processed in priority order, with lower numbers

  processed before higher numbers, because lower numbers have higher priority. Once traffic matches a rule, processing stops.

  HTTPS uses port 443.

  Rule2, with priority 500, denies HTTPS traffic.

  Rule5, with priority changed from 2000 to 401, would allow HTTPS traffic.

  Note: Priority is a number between 100 and 4096. Rules are processed in priority order, with lower numbers processed before higher numbers, because lower numbers have higher priority. Once traffic matches a rule, processing stops. As a result, any rules that exist with lower priorities (higher numbers) that have the same attributes as rules with higher priorities are not processed.

  References: https://docs.microsoft.com/en-us/azure/virtual-network/security-overview

• Question 434:

  You have two Azure Active Directory (Azure AD) tenants named contoso.com and fabrikam.com. You have a Microsoft account that you use to sign in to both tenants. You need to configure the default sign-in tenant for the Azure portal. What should you do?

  A. From the Azure portal, change the directory.

  B. From Azure Cloud Shell, run Set-AzContext.

  C. From the Azure portal, configure the portal settings.

  D. From Azure Cloud Shell, run Select- AzSubscription.

  Correct Answer: A

• Question 435:

  You have an Azure subscription named Subscription1 that contains an Azure virtual network named VM1. VM1 is in a resource group named RG1.

  VM1 runs services that will be used to deploy resources to RG1.

  You need to ensure that a service running on VM1 can manage the resources in RG1 by using the identity of VM1.

  What should you do first?

  A. From the Azure portal modify the Access control (IAM) settings of VM1.

  B. From the Azure portal, modify the Policies settings of RG1.

  C. From the Azure portal, modify the value of the Managed Service Identity option for VM1.

  D. From the Azure portal, modify the Access control (IAM) settings of RG1.

  Correct Answer: C

  A managed identity from Azure Active Directory allows your app to easily access other AAD- protected resources such as Azure Key Vault. The identity is managed by the Azure platform and does not require you to provision or rotate any

  secrets.

  User assigned managed identities can be used on Virtual Machines and Virtual Machine Scale Sets.

  References:

  https://docs.microsoft.com/en-us/azure/app-service/app-service-managed-service-identity

• Question 436:

  You plan to create the Azure web apps shown in the following table.

  

  What is the minimum number of App Service plans you should create for the web apps?

  A. 1

  B. 2

  C. 3

  D. 4

  Correct Answer: B

  Azure App Service plans define the region (Datacenter) of the physical server where your web app will be hosted and the amount of storage, RAM, and CPU the underlying virtual machine will have. One App Service plan can host multiple web apps, mobile apps, API apps, and function apps. All apps in the same plan run on the same VM instance(s) and share the same resources. Different runtime stacks (like .NET Core, ASP.NET, PHP, or Ruby) can coexist in the same App Service plan, provided they are supported by the operating system of the plan (Windows or Linux).

  Given the web apps you have:

  -WebApp1: .NET Core 3.1 (LTS) runs on both Windows and Linux.

  -WebApp2: ASP.NET v4.8 runs only on Windows.

  -WebApp3: PHP 7.3 runs on both Windows and Linux.

  -WebApp4: Ruby 2.6 typically runs on Linux. You can choose to have:

  1.

  One App Service plan for WebApp1, WebApp2, and WebApp3 all on Windows.

  2.

  A separate App Service plan for WebApp4 on Linux. This results in a total of 2 App Service plans.

• Question 437:

  You have two Azure Active Directory (Azure AD) tenants named contoso.com and fabrikam.com.

  You have a Microsoft account that you use to sign in to both tenants.

  You need to configure the default sign-in tenant for the Azure portal.

  What should you do?

  A. From the Azure portal, configure the portal settings.

  B. From the Azure portal, change the directory.

  C. From Azure Cloud Shell, run Set-AzureRmContext.

  D. From Azure Cloud Shell, run Set-AzureRmSubscription.

  Correct Answer: B

  The Set-AzureRmContext cmdlet sets authentication information for cmdlets that you run in the current session. The context includes tenant, subscription, and environment information.

  References: https://docs.microsoft.com/en-us/powershell/module/azurerm.profile/set-azurermcontext

• Question 438:

  You have an Azure subscription that contains a virtual machine named VM1. VM1 hosts a line-of- business application that is available 24 hours a day. VM1 has one network interface and one managed disk. VM1 uses the D4s v3 size. You plan to make the following changes to VM1:

  1.

  Change the size to D8s v3.

  2.

  Add a 500-GB managed disk.

  3.

  Add the Puppet Agent extension.

  4.

  Attach an additional network interface. Which change will cause downtime for VM1?

  A. Add a 500-GB managed disk.

  B. Attach an additional network interface.

  C. Add the Puppet Agent extension.

  D. Change the size to D8s v3.

  Correct Answer: D

  While resizing the VM it must be in a stopped state. References: https://azure.microsoft.com/en-us/blog/resize-virtual-machines/

• Question 439:

  You have an Azure subscription that contains 100 virtual machines.

  You regularly create and delete virtual machines.

  You need to identify unattached disks that can be deleted.

  What should you do?

  A. From Azure Advisor, modify the Advisor configuration.

  B. From Azure Cost Management view Cost Analysis.

  C. From Azure Cost Management view Advisor Recommendations.

  D. From Microsoft Azure Storage Explorer, view the Account Management properties.

  Correct Answer: C

  From Home -> Cost Management + Billing -> Cost Management, scroll down on the options and select View Recommendations

• Question 440:

  You have a deployment template named Template1 that is used to deploy 10 Azure web apps.

  You need to identify what to deploy before you deploy Template1. The solution must minimize Azure costs.

  What should you identify?

  A. 10 App Service plans

  B. one Azure Traffic Manager

  C. five Azure Application Gateways

  D. one App Service plan

  E. one Azure Application Gateway

  Correct Answer: D

  You create Azure web apps in an App Service plan.

  Reference:

  https://docs.microsoft.com/en-us/azure/app-service/overview-hosting-plans