Microsoft Microsoft Certifications AZ-104 Questions & Answers

• Question 501:

  HOTSPOT

  You have an Azure subscription.

  You plan to use Azure Resource Manager templates to deploy 50 Azure virtual machines that will be part of the same availability set.

  You need to ensure that as many virtual machines as possible are available if the fabric fails or during servicing.

  How should you configure the template? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: 2

  Use two fault domains.

  2 or 3 is max, depending on which region you are in.

  Box 2: 20

  Use 20 for platformUpdateDomainCount

  Increasing the update domain (platformUpdateDomainCount) helps with capacity and availability planning when the platform reboots nodes. A higher number for the pool (20 is max) means that fewer of their nodes in any given availability set

  would be rebooted at once.

  Reference:

  https://www.itprotoday.com/microsoft-azure/check-if-azure-region-supports-2-or-3-fault-domains-managed-disks

  https://github.com/Azure/acs-engine/issues/1030

• Question 502:

  HOTSPOT

  You have the Azure resources shown on the following exhibit.

  

  You plan to track resource usage and prevent the deletion of resources.

  To which resources can you apply locks and tags? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Sub1, RG1, and VM1 only

  You can lock a subscription, resource group, or resource to prevent other users in your organization from accidentally deleting or modifying critical resources.

  Box 2: Sub1, RG1, and VM1 only

  You apply tags to your Azure resources, resource groups, and subscriptions.

  Reference:

  https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources?tabs=json

  https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/tag-resources?tabs=json

• Question 503:

  HOTSPOT

  You have an Azure subscription named Subscription1 that contains a virtual network VNet1.

  You add the users in the following table.

  

  Which user can perform each configuration? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: User1 and User3 only.

  User1: The Owner Role lets you manage everything, including access to resources.

  User3: The Network Contributor role lets you manage networks, including creating subnets.

  Box 2: User1 only.

  The Security Admin role: In Security Center only: Can view security policies, view security states, edit security policies, view alerts and recommendations, dismiss alerts and recommendations.

  Reference:

  https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

  https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftnetwork

• Question 504:

  HOTSPOT

  You have an Azure subscription.

  You need to use an Azure Resource Manager (ARM) template to create a virtual machine that will have multiple data disks.

  How should you complete the template? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

• Question 505:

  HOTSPOT

  You have an Azure Active Directory (Azure AD) tenant.

  You want to implement Multi-Factor Authentication by making use of a conditional access policy. The conditional access policy must be applied to all users when they access the Azure portal.

  Which three settings should you configure? To answer, select the appropriate settings to the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1:

  The conditional access policy must be applied or assigned to Users and Groups.

  Box 2:

  The conditional access policy must be applied when users access the Azure portal, which is a cloud app.

  That is: Microsoft Azure Management

  Box 3:

  Access control must require multi-factor authentication when granting access.

  Reference:

  https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/app-based-mfa

• Question 506:

  HOTSPOT

  You have an Azure subscription that contains a storage account named storage1. The subscription is linked to an Azure Active Directory (Azure AD) tenant named contoso.com that syncs to an on-premises Active Directory domain.

  The domain contains the security principals shown in the following table.

  

  In Azure AD, you create a user named User2.

  The storage1 account contains a file share named share1 and has the following configurations.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/azure/storage/files/storage-files-identity-ad-ds-assign-permissions?tabs=azure-portal

• Question 507:

  HOTSPOT

  You have an Azure subscription that contains the public load balancers shown in the following table.

  

  You plan to create six virtual machines and to load balance requests to the virtual machines. Each load balancer will load balance three virtual machines. You need to create the virtual machines for the planned solution.

  Hot Area:

  

  Correct Answer:

  

  Box 1: be created in the same availability set or virtual machine scale set.

  The Basic tier is quite restrictive. A load balancer is restricted to a single availability set, virtual machine scale set, or a single machine.

  Box 2: be connected to the same virtual network

  The Standard tier can span any virtual machine in a single virtual network, including blends of scale sets, availability sets, and machines.

  Reference:

  https://www.petri.com/comparing-basic-standard-azure-load-balancers

• Question 508:

  HOTSPOT

  You have an Azure subscription that contains the virtual networks shown in the following table.

  

  The subscription contains the private DNS zones shown in the following table.

  

  You add virtual network links to the private DNS zones as shown in the following table.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/azure/dns/private-dns-virtual-network-links

  https://docs.microsoft.com/en-us/azure/dns/private-dns-autoregistration

• Question 509:

  HOTSPOT

  You have an on-premises data center and an Azure subscription. The data center contains two VPN devices. The subscription contains an Azure virtual network named VNet1. VNet1 contains a gateway subnet.

  You need to create a site-to-site VPN. The solution must ensure that if a single instance of an Azure VPN gateway fails, or a single on-premises VPN device fails, the failure will not cause an interruption that is longer than two minutes.

  What is the minimum number of public IP addresses, virtual network gateways, and local network gateways required in Azure? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: 4

  Two public IP addresses in the on-premises data center, and two public IP addresses in the VNET.

  The most reliable option is to combine the active-active gateways on both your network and Azure, as shown in the diagram below.

  

  Box 2: 2

  Every Azure VPN gateway consists of two instances in an active-standby configuration. For any planned maintenance or unplanned disruption that happens to the active instance, the standby instance would take over (failover) automatically,

  and resume the S2S VPN or VNet-to-VNet connections.

  Box 3: 2

  Dual-redundancy: active-active VPN gateways for both Azure and on-premises networks

  Reference:

  https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-highlyavailable

• Question 510:

  HOTSPOT

  You have an Azure subscription that contains the storage accounts shown in the following exhibit.

  

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: contoso104 only

  Premium file shares are hosted in a special purpose storage account kind, called a FileStorage account.

  Box 2: contoso101, contoso102, and contos103 only

  Reference:

  https://docs.microsoft.com/en-us/azure/storage/files/storage-how-to-create-premium-fileshare?tabs=azure-portal

  https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-storage-tiers