Microsoft Microsoft Certifications AZ-104 Questions & Answers

• Question 591:

  HOTSPOT

  You have the Azure management groups shown in the following table:

  

  You add Azure subscriptions to the management groups as shown in the following table:

  

  You create the Azure policies shown in the following table:

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: No

  Virtual networks are not allowed at the root and is inherited. Deny overrides allowed.

  Box 2: No

  Box 3: Yes

  Subscriptions can be moved between Management Groups provided the user has the required RBAC permissions.

• Question 592:

  HOTSPOT

  You have an Azure Active Directory (Azure AD) tenant named contoso.com that contains the users shown in the following table:

  

  User3 is the owner of Group1.

  Group2 is a member of Group1.

  You configure an access review named Review1 as shown in the following exhibit:

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  In the Users section, specify the users that the access review applies to. Access reviews can be for the members of a group or for users who were assigned to an application. You can further scope the access review to review only the guest users who are members (or assigned to the application), rather than reviewing all the users who are members or who have access to the application.

  

  Present Use Case:

  Group2 is a member of Group1 and User3 is the owner of Group1 So User3 can review both Group 1 and 2.

  But for review the scope says only Guest.

  Solution:

  User1 is a member not a guest so 1st statement ==> NO

  UserA is member not the guest so 2nd statement ==> No

  UserB is a guest so 3rd statement ==> Yes

  Reference:

  https://docs.microsoft.com/en-us/azure/active-directory/governance/create-access-review

• Question 593:

  HOTSPOT

  You have an Azure virtual machine mat runs Windows Server 2019 and has the following configurations:

  *

  Name:VM1

  *

  Location: Welt US

  *

  Connected to: VNfT1

  *

  Private IP address: 10.1.0.4

  *

  Public IP address: 52 18685.63

  *

  DNS suffix m Windows Server.Adatum.com

  You create the Azure DNS zones shown in the following table.

  

  Hot Area:

  

  Correct Answer:

  

• Question 594:

  HOTSPOT

  You have an Azure subscription named Subscription1 that contains a resource group named RG1.

  In RG1, you create an internal load balancer named LB1 and a public load balancer named LB2.

  You need to ensure that an administrator named Admin1 can manage LB1 and LB2. The solution must follow the principle of least privilege.

  Which role should you assign to Admin1 for each task? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

• Question 595:

  HOTSPOT

  You have Azure subscription that includes following Azure file shares:

  

  You have the following on-premises servers:

  

  You create a Storage Sync Service named Sync1 and an Azure File Sync group named Group1. Group1 uses share1 as a cloud endpoint.

  You register Server1 and Server2 in Sync1. You add D:\Folder1 on Server1 as a server endpoint of Group1.

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: No

  Group1 already has a cloud endpoint named Share1.

  A sync group must contain one cloud endpoint, which represents an Azure file share and one or more server endpoints.

  Box 2: No

  Box 3: Yes

  Yes, one or more server endpoints can be added to the sync group.

  References:

  https://docs.microsoft.com/en-us/azure/storage/file-sync/file-sync-server-endpoint-create?tabs=azure-portal

• Question 596:

  HOTSPOT

  You have an Azure subscription that contains the resource groups shown in the following table.

  

  RG1 contains the resources shown in the following table.

  

  RG2 contains the resources shown in the following table.

  

  You need to identify which resources you can move from RG1 to RG2, and which resources you can move from RG2 to RG1. Which resources should you identify? To answer, select the appropriate options in the answer area.

  Hot Area:

  

  Correct Answer:

  

  Read only and Delete lock won't prevent you from moving resources in different resource groups. It will prevent you to do the operations in the resource group where the resources are there. So the correct answer should be RG1 --> RG2 = IP1, vnet1 and storage1 RG2 --> RG1 = IP2, vnet2 and storage2

  Reference: https://docs.microsoft.com/en-us/azure/governance/blueprints/concepts/resource-locking

• Question 597:

  HOTSPOT

  You have an Azure subscription that contains the public load balancers shown in the following table.

  

  You plan to create six virtual machines and to load balancer requests to the virtual machines. Each load balancer will load balance three virtual machines. You need to create the virtual machines for the planned solution. How should you

  create the virtual machines? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: be created in the same availability set or virtual machine scale set. The Basic tier is quite restrictive. A load balancer is restricted to a single availability set, virtual machine scale set, or a single machine.

  Box 2: be connected to the same virtual network

  The Standard tier can span any virtual machine in a single virtual network, including blends of scale sets, availability sets, and machines.

  References:

  https://www.petri.com/comparing-basic-standard-azure-load-balancers

• Question 598:

  HOTSPOT

  You have an Azure subscription that contains an Azure Directory (Azure AD) tenant named contoso.com. The tenant is synced to the on-premises Active Directory domain. The domain contains the users shown in the following table.

  

  You enable self-service password reset (SSPR) for all users and configure SSPR to have the following authentication methods:

  *

  Number of methods required to reset: 2

  *

  Methods available to users: Mobile phone, Security questions

  *

  Number of questions required to register: 3

  *

  Number of questions required to reset: 3

  You select the following security questions:

  *

  What is your favorite food?

  *

  In what city was your first job?

  *

  What was the name of your first pet?

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: No Administrator accounts are special accounts with elevated permissions. To secure them, the following restrictions apply to changing passwords of administrators: On-premises enterprise administrators or domain administrators cannot reset their password through Self-service password reset (SSPR). They can only change their password in their on-premises environment. Thus, we recommend not syncing on-prem AD admin accounts to Azure AD. An administrator cannot use secret Questions and Answers as a method to reset password. Box 2: Yes Self-service password reset (SSPR) is an Azure Active Directory feature that enables employees to reset their passwords without needing to contact IT staff. Box 3: Yes References: https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-sspr-deployment

• Question 599:

  HOTSPOT

  You have an Azure Active Directory (Azure AD) tenant named adatum.com. Adatum.com contains the groups in the following table.

  

  You create two user accounts that are configured as shown in the following table.

  

  To which groups do User1 and User2 belong? To answer. select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Group 1 only First rule applies Box 2: Group1 and Group2 only Both membership rules apply. References: https://docs.microsoft.com/en-us/sccm/core/clients/manage/collections/create- collections

• Question 600:

  HOTSPOT

  You have a pay-as-you-go Azure subscription that contains the virtual machines shown in the following table.

  

  You create the budget shown in the following exhibit.

  

  The AG1 action group contains a user named [email protected] only. Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: VM1 and VM2 continue to run

  TWhen the budget thresholds you've created are exceeded, only notifications are triggered. None of your resources are affected and your consumption isn't stopped. You can use budgets to compare and track spending as you analyze costs.

  Box 2: one email notification will be sent each month.

  Budget alerts for Resource Group RG1, which include VM1, but not VM2.VM1 consumes 20 Euro/day. The 50%, 500 Euro limit, will be reached in 25 days, and an email will be sent.

  References:

  https://docs.microsoft.com/en-gb/azure/cost-management-billing/costs/tutorial-acm-create- budgets

  https://docs.microsoft.com/en-us/azure/cost-management-billing/costs/cost-mgt-alerts-monitor- usage-spending