Microsoft Microsoft Certifications AZ-104 Questions & Answers

• Question 541:

  HOTSPOT

  You have an on premises data center and an Azure subscription. The data center contains two VPN devices. The subscription contains an Azure virtual network named VNet1. VNet1 contains a gateway subnet.

  You need to create a site-to-site VPN. The solution must ensure that if a single instance of an Azure VPN gateway fails, or a single on-premises VPN device fails, the failure will not cause an interruption that is longer than two minutes.

  What is the minimum number of public IP addresses, virtual network gateways, and local network gateways required in Azure? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: 4

  Two public IP addresses in the on-premises data center, and two public IP addresses in the VNET. The most reliable option is to combine the active-active gateways on both your network and Azure, as shown in the diagram below.

  

  Box 2: 2

  Every Azure VPN gateway consists of two instances in an active-standby configuration. For any planned maintenance or unplanned disruption that happens to the active instance, the standby instance would take over (failover) automatically,

  and resume the S2S VPN or VNet-to-VNet connections.

  Box 3: 2

  Dual-redundancy: active-active VPN gateways for both Azure and on-premises networks Reference:

  https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-highlyavailable

• Question 542:

  HOTSPOT

  You have an Azure subscription named Subscription1 that contains the quotas shown in the following table.

  

  You deploy virtual machines to Subscription1 as shown in the following table.

  

  Hot Area:

  

  Correct Answer:

  

• Question 543:

  HOTSPOT

  You have an Azure Subscription named Subcription1.has Subcription1 contains the virtual machines in the following table.

  

  Subcription1 contains the virtual machines in the following table.

  

  VM3 has multiple network, including a network adapter named NIC3, IP forwarding is enabled on NIC3. Routing is enabled on VM3. You create a route table named RT1 that contains the routes in the following table.

  

  You apply RT1 to subnet1 and Sybnet2.

  For each of the following statements, select Yes if the statements is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  IP forwarding enables the virtual machine a network interface is attached to:

  1.

  Receive network traffic not destined for one of the IP addresses assigned to any of the IP configurations assigned to the network interface.

  2.

  Send network traffic with a different source IP address than the one assigned to one of a network interface's IP configurations.

  The setting must be enabled for every network interface that is attached to the virtual machine that receives traffic that the virtual machine needs to forward. A virtual machine can forward traffic whether it has multiple network interfaces or a

  single network interface attached to it.

  Box 1: Yes

  The routing table allows connections from VM3 to VM1 and VM2. And as IP forwarding is enabled on VM3, VM3 can connect to VM1.

  Box 2: No

  VM3, which has IP forwarding, must be turned on, in order for VM2 to connect to VM1.

  Box 3: Yes

  The routing table allows connections from VM1 and VM2 to VM3. IP forwarding on VM3 allows VM1 to connect to VM2 via VM3.

  References:

  https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview https://www.quora.com/What-is-IP-forwarding

• Question 544:

  HOTSPOT

  You have an Azure Kubernetes Service (AKS) cluster named AKS1 and a computer named Computer1 that runs Windows 10. Computer1 that has the Azure CLI installed.

  You need to install the kubectl client on Computer1.

  Which command should you run? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  To install kubectl locally, use the az aks install-cli command:

  az aks install-cli

  Reference:

  https://docs.microsoft.com/en-us/azure/aks/kubernetes-walkthrough

• Question 545:

  HOTSPOT

  You have peering configured as shown in the following exhibit.

  

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: vNET6 only

  Peering status to both VNet1 and Vnet2 are disconnected.

  Box 2: delete peering1

  Peering to Vnet1 is Enabled but disconnected. We need to update or re-create the remote peering to get it back to Initiated state.

  Reference:

  https://blog.kloud.com.au/2018/10/19/address-space-maintenance-with-vnet-peering/

• Question 546:

  HOTSPOT

  You have an Azure Active Directory (Azure AD) tenant named contoso.onmicrosoft.com that contains the users shown in the following table.

  

  You configure the authentication methods for password reset as shown in the Authentication Methods exhibit. (Click the Authentication Methods tab.)

  

  You configure the authentication methods for password reset as shown in the Authentication Methods exhibit. (Click the Authentication Methods tab.)

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: No

  Two methods are required.

  Box 2: No

  Self-service password reset is only enabled for Group2, and User1 is not a member of Group2.

  Box 3: Yes

  As a User Administrator, User3 can add security questions to the reset process.

  Reference:

  https://docs.microsoft.com/en-us/azure/active-directory/authentication/quickstart-sspr

  https://docs.microsoft.com/en-us/azure/active-directory/authentication/active-directory-passwords-faq

• Question 547:

  HOTSPOT

  You have an Azure subscription named Subscription1. Subscription1 contains the resources in the following table.

  

  VNet1 is in RG1. VNet2 is in RG2. There is no connectivity between VNet1 and VNet2.

  An administrator named Admin1 creates an Azure virtual machine named VM1 in RG1. VM1 uses a disk named Disk1 and connects to VNet1. Admin1 then installs a custom application in VM1.

  You need to move the custom application to VNet2. The solution must minimize administrative effort.

  Which two actions should you perform? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  We cannot just move a virtual machine between networks. What we need to do is identify the disk used by the VM, delete the VM itself while retaining the disk, and recreate the VM in the target virtual network and then attach the original disk to it.

  Reference: https://blogs.technet.microsoft.com/canitpro/2014/06/16/step-by-step-move-a-vm-to-a-different-vnet-on-azure/

  https://4sysops.com/archives/move-an-azure-vm-to-another-virtual-network-vnet/#migrate-an-azure-vm-between-vnets

• Question 548:

  HOTSPOT

  You have the App Service plans shown in the following table.

  

  You plan to create the Azure web apps shown in the following table.

  

  You need to identify which App Service plans can be used for the web apps.

  What should you identify? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: ASP1 ASP3

  Asp1, ASP3: ASP.NET Core apps can be hosted both on Windows or Linux.

  Not ASP2: The region in which your app runs is the region of the App Service plan it's in.

  Box 2: ASP1

  ASP.NET apps can be hosted on Windows only.

  Reference:

  https://docs.microsoft.com/en-us/azure/app-service/quickstart-dotnetcore?pivots=platform-linux

  https://docs.microsoft.com/en-us/azure/app-service/app-service-plan-manage#

• Question 549:

  HOTSPOT

  You have an Azure subscription that contains the resources shown in the following table.

  

  The status of VM1 is Running.

  You assign an Azure policy as shown in the exhibit. (Click the Exhibit tab.)

  

  You assign the policy by using the following parameters:

  Microsoft.ClassicNetwork/virtualNetworksMicrosoft.Network/virtualNetworksMicrosoft.Compute/virtualMachines

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Not allowed resource types (Deny): Prevents a list of resource types from being deployed. This means this policy specifically prevents a list of resource types from being deployed. So that refers that except deployment all the other operations like start/stop or move etc. are not prevented. But to be noted if the resource already exists, it just marks it as non-compliant. Replicated this scenario in LAB keeping VM running and below are the outcome :

  1.

  VM is not deallocated

  2.

  Able to stop and start VM successfully.

  3.

  Not able to create new virtual network or VM.

  4.

  Not able to modify VM size.

  5.

  Not able change the address space of the virtual network. ?Successfully moved virtual network and VM in another resource group.

  Statement 1 : Yes

  Based on above experiment the policy will mark the VNET1 as non-compliant but it can be moved to RG2 . Hence this statement is true.

  Statement 2 : No

  Based on above experiment the policy will mark the VM as non-compliant but it will still be running, not deallocated. Hence this statement is False.

  Statement 3 : No

  Based on above experiment the address space for VNET2 can not be modified. Hence this statement is False.

  Reference:

  https://docs.microsoft.com/en-us/azure/governance/policy/assign-policy-portal

• Question 550:

  HOTSPOT

  You have an Azure Storage account named storage1.

  You have an Azure Service app named App1 and an app named App2 that runs in an Azure container instance. Each app uses a managed identity.

  You need to ensure that App1 and App2 can read blobs from storage1. The solution must meet the following requirements:

  1.

  Minimize the number of secrets used.

  2.

  Ensure that App2 can only read from storage1 for the next 30 days.

  What should you configure in storage1 for each app? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  App1: Access keys

  App2: Shared access signature (SAS)

  A shared access signature (SAS) provides secure delegated access to resources in your storage account without compromising the security of your data. With a SAS, you have granular control over how a client can access your data. You can

  control what resources the client may access, what permissions they have on those resources, and how long the SAS is valid, among other parameters.

  Reference:

  https://docs.microsoft.com/en-us/azure/storage/common/storage-sas-overview